000039504 - RSA NetWitness Concentrator's behind number increases rapidly when Decoder's capture rate is 3~5 Gbps

Document created by RSA Customer Support Employee on Dec 25, 2020
Version 1Show Document
  • Comment • 0
  • View in full screen mode

Article Content

Article Number000039504
Applies ToRSA Product Set: RSA NetWitness Platform
RSA Product/Service Type: Core Appliance
RSA Version/Condition: 11.3, 11.4, 11.5
Platform: CentOS
 
IssueConcentrator's behind number increases rapidly when Decoder's capture rate is 3~5 Gbps.
User cannot investigate recent data.
 
CauseLow bandwidth between decoder and concentrator causes this problem.

'ethtool <interface>' command displays the speed is configured as 100 Mb/s which is 12.5 MB/s. (Convert bit/sec to byte/sec). 100Mb/s of speed is low for connectivity between decoder and concentrator.

# ethtool <interface> | grep Speed
        Speed: 100Mb/s


Below message occur at /var/log/messages.

Dec 16 17:30:26 GP-NWForensic-Con NwConcentrator[63941]: [Bandwidth] [info] Performing bandwidth test to device <ip address of decoder>:50004...
Dec 16 17:30:28 GP-NWForensic-Con NwConcentrator[63941]: [Bandwidth] [info] Received 25 MB at a transfer rate of 11.45 MB/sec or 96.0 Mbps from device '<ip address of decoder>:50004'
Dec 16 17:30:28 GP-NWForensic-Con NwConcentrator[63941]: [Bandwidth] [warning] The bandwidth score of 96.0 Mbps is low and may cause aggregation to fall behind from device '<ip address of decoder>:50004'

The result of 'netspeed' command also displays very low (about 5~10 MB/sec).
ResolutionThe network administrator should change their network connectivity(switch or hub) between the decoder and concentrator from 100baseT/Full to 1000 or 10000baseT/Full.
After changing the connectivity to 1000baseT/Full, netspeed results around 80~90MB/sec.

> netspeed 100MB
Response from compress command: Compression changed from 0 to 0, compression level is 0
Received 97.61 MB at a transfer rate of 97.51 MB/sec or 818 Mbps


The behind count starts to decrease after the network change.

Attachments

    Outcomes