000030504 - Empty collection is created if restoration fails because workbench service is stopped or restarted on RSA Security Analytics

Document created by RSA Customer Support Employee on Jun 14, 2016Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 3Show Document
  • View in full screen mode

Article Content

Article Number000030504
Applies ToRSA Product Set: Security Analytics
RSA Product/Service Type: Security Analytics UI, Security Analytics Server, Archiver, Workbench
RSA Version/Condition: 10.5.x,
Platform: CentOS
O/S Version: EL6
IssueAn empty collection is seen in the Collections tab on the Workbench config page if the workbench service on the Archiver stops or restarts during the restoration process.
User-added image
The /var/lib/netwitness/uax/logs/sa.log file on the Security Analytics Server reports the following error message:
2015-03-03 08:10:09,419 [org.springframework.scheduling.quartz.SchedulerFactoryBean#0_Worker-3] INFO  org.quartz.core.JobRunShell - Job admin.a073989a-629e-4060-8583-b2e048b1e83b threw a JobExecutionException:
org.quartz.JobExecutionException: terminated [See nested exception: com.rsa.smc.sa.workbench.exception.WorkbenchServiceException: terminated]
        at com.rsa.smc.sa.workbench.job.RestoreCollectionJob.executeJob(RestoreCollectionJob.java:75)
        at com.rsa.netwitness.carlos.scheduling.jobs.AbstractJob.execute(AbstractJob.java:61)
        at org.quartz.core.JobRunShell.run(JobRunShell.java:213)
        at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:557)
Caused by: com.rsa.smc.sa.workbench.exception.WorkbenchServiceException: terminated
        at com.rsa.smc.sa.workbench.service.DefaultWorkbenchService.createRestorationCollection(DefaultWorkbenchService.java:243)
        at com.rsa.smc.sa.workbench.job.RestoreCollectionJob.executeJob(RestoreCollectionJob.java:61)
        ... 3 more
Caused by: com.rsa.smc.sa.common.exception.MessagingException: Failed to process message restore for /workbench/collections  com.rsa.netwitness.carlos.transport.TransportException: terminated

The /var/log/messages file on the Archiver appliance reports the following error:
Mar  3 08:02:35 Archiver nw[2708]: [Workbench] [warning] Error during restoring collection 'Test7': Unable to create ServerManagerPtr
ResolutionThis issue is currently being investigated by the Engineering team in order for it to be resolved in a future release.
If you have any additional questions or concerns regarding the issue, contact RSA Support and quote this article number for further assistance.