Export Connector Install: Known Issues

Document created by RSA Information Design and Development Employee on Oct 15, 2020Last modified by RSA Product Team on Oct 15, 2020
Version 2Show Document
  • View in full screen mode
ComponentsTitle, Problem & WorkaroundFound In /
Exists In
Fixed VersionTracking
Number

NetWitness Export Connector

Title: Position tracking is not updated properly when query is used to filter the sessions.
Problem: Last session.id aggregated is not updated to the latest aggregated ID but is updated only to the last filtered session retrieved. For Example, If a decoder has 1000 sessions, and only first 800 sessions match the filter, the last.session.id in the position tracking shows 800 even though all 1000 sessions are processed. This does not cause any data loss but if the Logstash service is restarted, aggregation will begin from 801 session.id, processing the 200 sessions again.
Workaround: None

netwitness-export-connector-1.0.0

 

ASOC-101795
NetWitness Export ConnectorTitle: Consumer does not consume all the events after the Logstash service is restarted.
Problem: While running at a high EPS or if there is a large session behind, the NetWitness Export Connector aggregates the sessions of the decoders. The Logstash pipeline sends to the output plugin which in turn sends it out to the consumer. At this point, if a Logstash service is stopped or restarted, the Logstash pipeline ensures the data is sent out of the output plugin to the consumer, however all the sessions are not consumed by the consumer. This leads to data loss on the consumer end even though Logstash has sent out all the data.
Workaround: Update the start_session parameter in the Logstash configuration file (netwitness-<decoder-ip>-input.conf) by referring to the latest received session.id on Kafka or any other consumer used.
netwitness-export-connector-1.0.0 ASOC-102440
NetWitness Export Connector

Title: Position tracking not saved for some Decoder sources after sometime in a multiple sources configuration.

Problem: When aggregating data from multiple sources in a single Logstash instance, after a period of time, the position tracking thread fails for some or all of the sources gradually and stops tracking the position (bookmarking) for those sources.

Workaround: None

netwitness-export-connector-1.0.0

 

ASOC-102411

NetWitness Export Connector

Title: Unable to start session aggregation from first.session.id of Decoder when it is not 1.

Problem: If the Decoder has the first.session.id other than 1, which means the Decoder has data that has rolled over, the NetWitness Export Connector's start_session parameter will not start aggregation from that value, instead it would begin from the last.session.id.

Workaround: Add 1 to the value to the start_session parameter and the aggregation would start as expected dropping the first session only. For example, if first.session.id on a Decoder is '1105000' add 1 to it and set the value of the start_session parameter as '1105001'.

netwitness-export-connector-1.0.0 ASOC-101951

 

You are here

Table of Contents > Known Issues

Attachments

    Outcomes