000031912 - Aggregation failed to start on Concentrator with the error "Message start was not recognized by /concentrator" in RSA Security Analytics

Document created by RSA Customer Support Employee on Jun 14, 2016•Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 2Show Document
  • Comment • 0
  • View in full screen mode

Article Content

Article Number000031912
Applies ToRSA Product Set: Security Analytics
RSA Product/Service Type: Concentrator
RSA Version/Condition: 10.4.0.x, 10.5.x
Platform: CentOS
O/S Version: EL6
 
IssueAfter a restart of a Concentrator, aggregation fails to start and the error message below is displayed.
Aggregation failed to start.: Failed to process message start for /concentrator 
com.rsa.netwitness.carlos.transport.TransportException: Message start was not recognized by /concentrator
ResolutionThis is to be expected and the product is functioning as designed.
It happens not only when rebooting the appliance, but if when restarting the services (concentrator) also.
When watching that appliance in the Health and Wellness portion of the UI and looking when the service is coming up, it takes some time before the aggregation actually starts because it is “initializing databases” and “initializing the SDK” so as soon as everything is initialized properly, the aggregation starts.

Attachments

    Outcomes

      Visibility: RSA NetWitness Logs & Network Knowledge Base1207 Views
      Last modified on Apr 21, 2017 7:28 PM
      Tags:
      Ratings: