000017414 - RSA NetWitness Platform IPDB Extractor is unable to read the .dir file

Document created by RSA Customer Support Employee on Jun 14, 2016Last modified by RSA Customer Support on Sep 26, 2019
Version 3Show Document
  • View in full screen mode

Article Content

Article Number000017414
Applies ToRSA Product Set: NetWitness Logs & Network
RSA Product/Service Type: IPDB Extractor
RSA Version/Condition: 10.6.x
IssueUnable to start the IPDB Extractor service (nwipdbextractor).

In the NetWitness UI, Administration > Services > {IPDB Extractor}, edit Test Connection fails.

The nwipdbextractor service is started/running but is not listening on the TCP/50125 port.
 

The /var/log/message file shows errors similar to the following:
 




Apr 29 15:13:42 NWAPPLIANCE14833 nw[24527]: [ipdbextractorinit] [failure] Failed to read dir file from location /var/netwitness/ipdbextractor/devicelocation/global/local/directory/
Apr 29 15:13:42 NWAPPLIANCE14833 nw[24527]: [ipdbextractorinit] [failure] Ensure that the .dir file exists in the path as mentioned in the config "Mount point of the .dir file". Extractor will retry reading the .dir file after 1 minute.
CauseThe IPDB Extractor service (nwipdbextractor) doesn't start listening on port TCP/50125 until the service is able to access the enVision IPDB .dir file under the configured dirfile.location directory (default directory, /var/netwitness/ipdbextractor/devicelocation).
Resolution

Ensure the CIFS share to the IPDB files location is correctly configured and accessible per the IPDB Extractor Service Configuration Guide for Version 10.6.5



Once the CIFS share to the device location directory is accessible, confirm the .dir file exists under a sub-directory and is readable.

Typical sub-directory paths to the .dir file can be,

/var/netwitness/ipdbextractor/devicelocation/global/local/directory/{filename}.dir
/var/netwitness/ipdbextractor/devicelocation/global/remote/directory/{filename}.dir

Where
{filename} is the site name given to the enVision installation.

Confirm the .dir file is readable with a command like,
 




# strings /var/netwitness/ipdbextractor/devicelocation/global/local/directory/enVsite.dir |head
enVsite
local
1567476306
enVsite^192.168.1.132^2010
656b8c3a-223c-45a6-9ae4-a129967dd67c
enVsite
enVsite-DS1
enVsite-DS1
192.168.1.131
NIC System


A readable .dir file will return so text from the file.
 

Every minute, the IPDB Extractor service looks for this file. Until the user supplies this file, the service will not start listening on TCP/50125.

In summary, the IPDBExtractor service requires both the .dir file and that the IPDB be mounted using CIFS before it will start cleanly.

Legacy Article IDa65310

Attachments

    Outcomes