000017621 - The cache setting on an RSA Security Analytics or RSA NetWitness concentrator results in 'Invalid Magic Number' or 'The storage usage percentage hsa exceeded 99%' errors

Document created by RSA Customer Support Employee on Jun 14, 2016Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 2Show Document
  • View in full screen mode

Article Content

Article Number000017621
Applies ToRSA Security Analytics
RSA Security Analytics Concentrator
RSA Security Analytics Hybrid
RSA NetWitness NextGen
RSA NetWitness Investigator
RSA NetWitness Administrator
IssueThe cache setting on an RSA Security Analytics or RSA NetWitness concentrator results in "Invalid Magic Number" or "The storage usage percentage hsa exceeded 99%" errors.
The following error message is displayed in the log files on on the appliance:  The storage usage percentage has exceeded 99%

An error message similar to the following is displayed in the logs or in the RSA NetWitness Investigator client:  The file "/var/netwitness/concentrator/cache/879742040.nwd" has an invalid magic number.

CauseThe /var/netwitness/concentrator partition on certain early Concentrator build images was set to 3GB instead of 30GB, but the cache uses this volume and is by default set to 4GB, thus causing the cache to exceed the size of the partition.

The cache size must be lowered to 2GB. To verify it is currently set incorrectly, log into the Concentrator via SSH and run the df -h command. You should get output similar to the following:

/dev/mapper/concentrator-root 3.0G   69M  2.8G   3% /var/netwitness/concentrator

To set the cache size to 2GB, follow the steps below. 

  1. Access the Explore view of the appliance using one of the methods below.

    RSA NetWitness Administrator:
      a.  Connect to the concentrator in question.
      b.  Open Explorer by right-clicking on the concentrator and selecting Explorer.

    RSA Security Analytics:
      a.  Navigate to Administration -> Devices.
      b.  Select the concentrator and click on View -> Explore.
  2. Navigate in the tree to /sdk/config.
  3. Under cache.size, change the number from 4096 to 2048. The changes will take affect immediately.
  4. In addition, if /sdk/config/cache.size is already set to 2048, verify whether or not /rest/config/cache.size is set to 1024 and change it to 768 if necessary.
    NOTE:  In RSA NetWitness NextGen, due to a bug, you may have to specify "768 MB" instead, though this is fixed in future releases.
  5. Restart the concentrator service for this change to take effect.


If you are unsure of any of the steps above or experience any issues, contact RSA Support and quote this article ID for further assistance.


The screenshot below displays where the cache.size parameter is located in the Explore view in the RSA NetWitness Administrator thick client.  The location will be the same in the Explore view within the RSA Security Analytics UI.

Legacy Article IDa58747