000038245 - Unable to export Application Rules in RSA NetWitness Platform 11.x when there are more than 500+ Application Rules

Document created by RSA Customer Support Employee on Dec 24, 2019
Version 1Show Document
  • Comment • 0
  • View in full screen mode

Article Content

Article Number000038245
Applies ToRSA Product Set: NetWitness Platform
RSA Product/Service Type: Decoder
RSA Version/Condition: 11.0.x, 11.1.x, 11.2.x, 11.3.x
Platform: CentOS 7
IssueUnable to export all existing Application Rules in Decoders (Actions > Export > All) if there are more than 500 of them and a system error occurs.

Export All in Decoder-Config

System Error
CauseLimitation with code for App Rule export.

sa.log

2019-05-31 09:06:58,515 [org.springframework.scheduling.quartz.SchedulerFactoryBean#0_Worker-8] INFO  org.quartz.core.JobRunShell - Job admin.59440405-d363-4d50-b778-4e340fb117e9 threw a JobExecutionException: 
org.quartz.JobExecutionException: Error retrieving PCAP from service: TransportException: 28800000 ms timeout reached waiting for server response [See nested exception: com.rsa.smc.sa.common.exception.MessagingException: Failed to retrieve content]
 at com.rsa.smc.sa.investigation.common.export.jobs.ExtractInvestigationPcapJob.executeJob(ExtractInvestigationPcapJob.java:91)
ResolutionFix 11.4.
 
WorkaroundSelect App Rules into groups and export them as workaround.
For example, if there are 520 App Rules, then select All and deselect 20 App Rules. Export 500 App Rules first and another export the remaining 20 App Rules.

Attachments

    Outcomes