000038999 - "[Lua] [failure] LUA_ERRRUN" errors after upgrade to RSA NetWitness Decoder 11.3.x

Document created by RSA Customer Support Employee on Jun 23, 2020
Version 1Show Document
  • Comment • 0
  • View in full screen mode

Article Content

Article Number000038999
Applies ToRSA Product Set: RSA NetWitness Platform
RSA Product/Service Type: Core Appliance
RSA Version/Condition: 11.3.2.0
Platform: Cent OS
O/S Version: 7
Product Description: NW Network Monitoring Perpetual
IssueAfter upgrade to 11.3.x, you may repeatedly see the following error messages from /var/log/messages.

NwDecoder[5878]: [Lua] [failure] LUA_ERRRUN: [string "session_analysis.luax"]:734: attempt to index field 'sessionVars' (a nil value)
NwDecoder[5878]: [Lua] [failure] LUA_ERRRUN: [string "session_analysis.luax"]:734: attempt to index field 'sessionVars' (a nil value)
NwDecoder[5878]: [Lua] [failure] LUA_ERRRUN: [string "session_analysis.luax"]:734: attempt to index field 'sessionVars' (a nil value)
NwDecoder[5878]: [Lua] [failure] Throw in function void nw::LuaState::ecall(int, int)Dynamic exception type: boost::exception_detail::clone_impl<nw::LuaError>std::exception::what: LUA_ERRRUN: [string "session_analysis.luax"]:734: attempt to index field 'sessionVars' (a nil value)[boost::errinfo_at_line_*] = 181
NwDecoder[5878]: [Lua] [failure] LUA_ERRRUN: [string "session_analysis.luax"]:734: attempt to index field 'sessionVars' (a nil value)
NwDecoder[5878]: [Lua] [failure] Throw in function void nw::LuaState::ecall(int, int)Dynamic exception type: boost::exception_detail::clone_impl<nw::LuaError>std::exception::what: LUA_ERRRUN: [string "session_analysis.luax"]:734: attempt to index field 'sessionVars' (a nil value)[boost::errinfo_at_line_*] = 181
NwDecoder[5878]: [Lua] [failure] Throw in function void nw::LuaState::ecall(int, int)Dynamic exception type: boost::exception_detail::clone_impl<nw::LuaError>std::exception::what: LUA_ERRRUN: [string "session_analysis.luax"]:734: attempt to index field 'sessionVars' (a nil value)[boost::errinfo_at_line_*] = 181
CauseThe lua parsers call-back have changed in 11.3.x, thus it is causing these issues.
These issues are being observed especially for following Lua parsers.
  • TLD_Lua
  • traffic_flow_lua
  • MAIL_Lua
  • session_analysis
WorkaroundYou should deploy the latest lua parsers from Live to eliminate the errors.

Attachments

    Outcomes