000012067 - Error message ''File(s) has been purged and is no longer available from the repository' on an RSA NetWitness Spectrum appliance

Document created by RSA Customer Support Employee on Jun 14, 2016Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 2Show Document
  • View in full screen mode

Article Content

Article Number000012067
Applies ToRSA NetWitness Spectrum
RSA NetWitness Spectrum 1.1.5.2
RSA NetWitness Spectrum 1.1.5.5
IssueError message "'File(s) has been purged and is no longer available from the repository" on an RSA NetWitness Spectrum appliance.
Within a Spectrum event if you attempt to download a file, the following message is dispalyed:  File(s) has been purged and is no longer available from the repository.
Cause

There are two reasons that this issue would occur:

  1. The file has been purged.
  2. Spectrum limitation on how we store files.

Spectrum keeps the files for about 60 days before being purged. Since your event just occurred, the problem appears to be from a Spectrum limitation. When Spectrum stores the files, it uses the hash in the path. For example, a file named file.pdf with a hash of 0a292ed4ce2cb1ee42bc20fd3ffb30b8 can be found in the following location:

/var/lib/netwitness/spectrum/repository/files/0a/0a292ed4ce2cb1ee42bc20fd3ffb30b8/file.pdf

If another file, say named anotherfile.pdf, is introduced into Spectrum and has the same hash, it would not be stored because the same file already exists (just named differently).

So when a user requests to download anotherfile.pdf, the error occurs.

Resolution

To debug:

Right-click the ?download file? link and copy the link address. It should look something like this:  actions391820599.downloadFromRepository('0a292ed4ce2cb1ee42bc20fd3ffb30b8', true, '391820599')

Use the hash to look for a file in the repository, as shown below.

/var/lib/netwitness/spectrum/repository/files/<firsttwocharsofhash>/<hash>/


There should be a file in there, but not necessarily named the same as the Event?s filename.

Legacy Article IDa60812

Attachments

    Outcomes