|Applies To||RSA Security Analytics|
RSA Security Analytics Concentrator
RSA Security Analytics Hybrid
RSA NetWitness NextGen
RSA NetWitness Investigator
RSA NetWitness Administrator
|Issue||The cache setting on an RSA Security Analytics or RSA NetWitness concentrator results in "Invalid Magic Number" or "The storage usage percentage hsa exceeded 99%" errors.|
The following error message is displayed in the log files on on the appliance: The storage usage percentage has exceeded 99%
An error message similar to the following is displayed in the logs or in the RSA NetWitness Investigator client: The file "/var/netwitness/concentrator/cache/879742040.nwd" has an invalid magic number.
|Cause||The /var/netwitness/concentrator partition on certain early Concentrator build images was set to 3GB instead of 30GB, but the cache uses this volume and is by default set to 4GB, thus causing the cache to exceed the size of the partition.|
The cache size must be lowered to 2GB. To verify it is currently set incorrectly, log into the Concentrator via SSH and run the df -h command. You should get output similar to the following:
To set the cache size to 2GB, follow the steps below.
If you are unsure of any of the steps above or experience any issues, contact RSA Support and quote this article ID for further assistance.
The screenshot below displays where the cache.size parameter is located in the Explore view in the RSA NetWitness Administrator thick client. The location will be the same in the Explore view within the RSA Security Analytics UI.
|Legacy Article ID||a58747|