000032107 - Schedule index slice saves to run at a specific time in RSA Security Analytics

Document created by RSA Customer Support Employee on Jun 14, 2016•Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 3Show Document
  • Comment • 0
  • View in full screen mode

Article Content

Article Number000032107
Applies ToRSA Product Set: Security Analytics, NetWitness
RSA Product/Service Type: Concentrator
RSA Version/Condition: 9.8.x, 10.3.x, 10.4.x, 10.5.x
Platform: CentOS
O/S Version: EL5, EL6
 
IssueA user wishes to initiate index save operation at a specific time rather than the default of every 8 hours.
 
TasksUse the steps outlined in this article to set one or more specific times to run the index save operations. 
  1. Log into the Security Analytics UI and select the Concentrator service.
  2. Open the Config tab for the Concentrator service.
  3. Select the Files tab.
  4. Select the scheduler file from the picklist.  Note that files are not presented in alphabetical order.
  5. In the text editor, make the following changes:
     
    Existing ValueNew Value
    hours=8 pathname=/index msg=save# hours=8 pathname=/index msg=save
     time=<HH:MM:SS> pathname=/index msg=save
     time=<HH:MM:SS> pathname=/index msg=save
     time=<HH:MM:SS> pathname=/index msg=save


  6. Click Apply.
  7. Restart the Concentrator service.
 
NotesYou must enter a separate line for each specific time you wish to save an index slice.
For example, to run the index save operation at 1:00:00, 9:00:00 and 17:00:00 enter the following three lines in the scheduler:
time=1:00:00 pathname=/index msg=save
time=9:00:00 pathname=/index msg=save
time=17:00:00 pathname=/index msg=save


If you only enter one time, it will be the functional equivalent of setting "hours=24" and will run once per day at that specified time. 
You may not use both an interval and specific time in the configuration file concurrently.  That is, you may not specific an "hours=x" and a "time=HH:MM:SS" in the scheduler simultaneously.
Generally you will be warned if you make a syntactical error.  However, some invalid entries may not be properly validated and may prevent you from successfully restarting the Concentrator service.  

 

Attachments

    Outcomes