000038806 - Initialization error on RSA NetWitness Concentrator

Document created by RSA Customer Support Employee on May 6, 2020
Version 1Show Document
  • Comment • 0
  • View in full screen mode

Article Content

Article Number000038806
Applies ToRSA Product Set: RSA NetWitness Platform
RSA Product/Service Type: Core Appliance
RSA Version/Condition: 11.x
IssueConcentrator aggregation stops due to an Initialization error. Below error appears in /var/log/messages.

Module concentrator failed to load: Diagnostic information: Throw in function nw::LanguageTokenPtr nw::Language::addToken(const nw::LanguageKey&, NwVariantFormat, const string&, nw::LanguageToken::TokenLevel, nw::uint32, nw::uint32, nw::uint32, nw::uint32, nw::uint32, nw::LanguageToken::NGram, double)
Dynamic exception type: boost::exception_detail::clone_impl<nw::LogicError>
std::exception::what: Language key Function conflicts with function, cannot add two keys with the same case insensitive names
[boost::errinfo_at_line_*] = 152
CauseThe index-concentrator.xml and index-concentrator-custom.xml contain the same Function meta key with insensitive names.
For example, 

GOOD: index-concentrator.xml 

<key description="Function" name="function" format="Text" level="IndexValues" valueMax="100"/>

WRONG: index-concentrator-custom.xml 


<key description="Function"  level="IndexValues" name="Function" format="Text" valueMax="100000" defaultAction="Open"/>


 
ResolutionChange the name for the meta key Function in case sensitive from /etc/netwitness/ng/index-concentrator-custom.xml
FROM:

<key description="Function"  level="IndexValues" name="Function" format="Text" valueMax="100000" defaultAction="Open"/>

TO:


<key description="Function"  level="IndexValues" name="function" format="Text" valueMax="100000" defaultAction="Open"/>


 

Attachments

    Outcomes