000017726 - VMware Log Collection keeps on getting stuck at a certain number of events in RSA Security Analytics

Document created by RSA Customer Support Employee on Jun 14, 2016Last modified by RSA Customer Support Employee on Apr 22, 2017
Version 2Show Document
  • View in full screen mode

Article Content

Article Number000017726
Applies ToRSA Security Analytics
RSA Security Analytics 10.3.3
RSA Security Analytics Log Collector
VMware vCenter Server 5.5.0
IssueVMware Log Collection keeps on getting stuck at a certain number of events in RSA Security Analytics.

The number of events as seen in /logcollection/vmware/stats/eventsources/vmware-events/<VMware_Event_Source_Name> in Log Collector's Explore view is not able to exceed a certain number.


Attempt to pull events from vCenter using perl script NwVmwareCollector.pl [script installed from: nwlogcollector-10.3.3.13667-5.el6.x86_64.rpm]:
perl /etc/netwitness/ng/logcollection/content/collection/vmware/vmware-events/NwVmwareCollector.pl -events -server <vcenter_server_ip> -username <user> -password <pass> -count 1000

Example successful output:
Perl exited with active threads:
1 running and unjoined
0 finished and unjoined
0 running and detached


Example failure output:
Can't load class 'ArrayOfDatastoreEventArgument' at /usr/local/share/perl5/VMware/VIMRuntime.pm line 52.
Perl exited with active threads:
1 running and unjoined
0 finished and unjoined
0 running and detached


You may need to run NwVmwareCollector.pl a number of times on progressively larger record counts to find where this issue is.
CauseThis occurs because of an issue in a file in the VMware Perl SDK.

/usr/local/share/perl5/VMware/VIM25Stub.pm originally distributed as part of nwlogcollectorperl-10.2.5.0-1.noarch.rpm
ResolutionDownload the file attached to this KB article and rename file back to VIM25Stub.pm
Replace the following file/usr/local/share/perl5/VMware/VIM25Stub.pm
Legacy Article IDa67207

Attachments

    Outcomes