Article Number | 000038245 |
Applies To | RSA Product Set: NetWitness Platform RSA Product/Service Type: Decoder RSA Version/Condition: 11.0.x, 11.1.x, 11.2.x, 11.3.x Platform: CentOS 7 |
Issue | Unable to export all existing Application Rules in Decoders (Actions > Export > All) if there are more than 500 of them and a system error occurs.

 |
Cause | Limitation with code for App Rule export.
sa.log
2019-05-31 09:06:58,515 [org.springframework.scheduling.quartz.SchedulerFactoryBean#0_Worker-8] INFO org.quartz.core.JobRunShell - Job admin.59440405-d363-4d50-b778-4e340fb117e9 threw a JobExecutionException: org.quartz.JobExecutionException: Error retrieving PCAP from service: TransportException: 28800000 ms timeout reached waiting for server response [See nested exception: com.rsa.smc.sa.common.exception.MessagingException: Failed to retrieve content] at com.rsa.smc.sa.investigation.common.export.jobs.ExtractInvestigationPcapJob.executeJob(ExtractInvestigationPcapJob.java:91)
|
Resolution | Fix 11.4. |
Workaround | Select App Rules into groups and export them as workaround. For example, if there are 520 App Rules, then select All and deselect 20 App Rules. Export 500 App Rules first and another export the remaining 20 App Rules. |