000031490 - Security Analytics Concentrator fails to start aggregation with error: "TransportException: Message start was not recognized by /concentrator"

Document created by RSA Customer Support Employee on Jun 14, 2016Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 2Show Document
  • View in full screen mode

Article Content

Article Number000031490
Applies ToRSA Product Set: Security Analytics
RSA Product/Service Type: SA Security Analytics Server
RSA Version/Condition: 10.4.0.x /
Platform: CentOS
O/S Version: 6
IssueThe following error message are noticed when attempting to start aggregation on a Security Analytics Concentrator:
Aggregation failed to start.: Failed to process message start for /concentrator 

com.rsa.netwitness.carlos.transport.TransportException: Message start was not recognized by /concentrator
ResolutionThis error message is a normal and common occurance.  It will always will appear when a concentrator appliance is rebooted, and if the concentrator service is restarted from the command line.
When watching that appliance in the Health and Wellness portion of the UI this message will appear when the service is coming up> Note that it can take some time for aggregation to complete its start sequences, such as “initializing databases” and “initializing the SDK”. Once databases and the sdk hooks are initialized properly, aggregation will then start.
Under these circumstances, these errors are "non" errors, and are part of the normal start up sequence.