000030616 - SA 10.5 - Multiple entries in Index-Concentrator-Custom File causes Initialization Error: "Cannot have more than one root element, trying to add 'key' when 'key' already exists"

Document created by RSA Customer Support Employee on Jun 14, 2016Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 2Show Document
  • View in full screen mode

Article Content

Article Number000030616
Applies ToSecurity Analytics Concentrator 10.5
Issue

When trying to add more than one entry in the index-concentrator-custom.xml file, the following errors appear in /var/log/messages
NWAPPLIANCE18030 nw[4636]: [Engine] [warning] Module concentrator failed to load: /etc/netwitness/ng/index-concentrator-custom.xml - Cannot have more than one root element, trying to add 'key' when 'key' already exists
NWAPPLIANCE18030 nw[4636]: [Engine] [warning] Module concentrator failed to load: Diagnostic information: Throw in function static void nw::LanguageManager::loadLanguageExtensions(const string&, nw::LanguagePtr)Dynamic exception type: N5boost16exception_detail10clone_implIN2nw8XmlErrorEEEstd::exception::what: /etc/netwitness/ng/index-concentrator-custom.xml - Cannot have more than one root element, trying to add 'key' when 'key' already exists[PN5boost16errinfo_at_line_E] = 388

CauseThese errors occur when the index-concentrator-custom.xml file is not formatted properly. 
ResolutionThe following steps will need to be performed to resolve the issue: 
  1. Back up the existing index-concentrator-custom.xml file
  2. Replace the contents of the file with the provided template
  3. Append contents of backup to provided template
  4. Restart concentrator service
WorkaroundThe index-concentrator-custom.xml file will need to be modified to be in a valid XML format. Perform the following steps: 
  1. Go to Administration>Services
  2. Select the concentrator then go to view>config and select files
  3. From the left drop-down menu select index-concentrator-custom.xml 
  4. **Select everything in this file and copy it to a safe location (like a .txt file on your local desktop)**
  5. After you have safely backed-up your file, you will now need to overwrite it with the following template: 
<?xml version="1.0" encoding="utf-8"?>
<language level="IndexValues" defaultAction="Auto">
<!-- *** Please insert your custom keys or modifications below this line *** -->
</language>

  1. Add the XML code lines that you backed up below the line noted in the template above. Your finished product should look similar to the following example: 
<?xml version="1.0" encoding="utf-8"?>
<language level="IndexValues" defaultAction="Auto">
<!-- *** Please insert your custom keys or modifications below this line *** -->
<key description="Bytes" format="UInt64" level="IndexValues" name="bytes" valueMax="250000" defaultAction="Open"/>
<key description="Business Network" format="Text" level="IndexValues" name="business" valueMax="1000" defaultAction="Open"/>
</language>

  1. Stop the concentrator capture by going to Administration>Services, selecting the concentrator view>system and then selecting Stop Aggregation. This process may take a few minutes. You will know when it is completed when the Start Aggregation button is not longer grayed out.  
  2. Restart the concentrator service by going to Administration>Services, selecting the concentrator view>system and then selecting Shutdown Service. Selecting Shutdown Service will stop the concentrator service and then automatically restart it.

Attachments

    Outcomes