000030831 - Incorrect syntax in core appliance custom index file causes initialization errors in RSA Security Analytics 10.5.0.1 and above

Document created by RSA Customer Support Employee on Jun 14, 2016•Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 2Show Document
  • Comment • 0
  • View in full screen mode

Article Content

Article Number000030831
Applies ToRSA Product Set: Security Analytics
RSA Product/Service Type: Decoder, Log Decoder, Concentrator, Broker
RSA Version/Condition: 10.5.0.1, 10.5.0.2
Platform: CentOS
O/S Version: EL6
IssueWhen starting a Broker, Concentrator, Packet Decoder or Log Decoder, an initialization error is displayed if the custom index file fails an XML syntax enforcement scan in Security Analytics 10.5.0.1.
These files are found in the /etc/netwitness/ng directory on the appliance and are named with the following syntax:  index-<service>-custom.xml
NOTE:  <service> will be decoder, concentrator, or broker depending on the service type.

 
CauseThe index-<service>-index.xml file is now scanned for proper XML syntax when the core services load.
WorkaroundIf you experience this error, add the proper XML header and footer to the XML file to correct the error.
Examples of proper headers and footers are shown below.
Decoder or Log Decoder example:
<?xml version="1.0" encoding="utf-8"?>
<language level="IndexNone" defaultAction="Auto">
<!-- *** Please insert your custom keys or modifications below this line *** -->
</language>

Concentrator or Broker example:
<?xml version="1.0" encoding="utf-8"?>
<language level="IndexValues" defaultAction="Auto">
<!-- *** Please insert your custom keys or modifications below this line *** -->
</language>

Attachments

    Outcomes