000034489 - UI Performance impact when CSV file is inaccessible for a remote feed in the Netwitness Suite

Document created by RSA Customer Support Employee on Dec 2, 2016Last modified by RSA Customer Support Employee on Apr 22, 2017
Version 2Show Document
  • View in full screen mode

Article Content

Article Number000034489
Applies ToRSA Product Set: Security Analytics
RSA Product/Service Type: SA Security Analytics Server
RSA Version/Condition: 10.6.0 - 10.6.2
IssueOn the RSA Security Analytics server the Jetty web server will throw a NullPointerException if a feed file cannot be reached.
ERROR com.rsa.smc.sa.core.service.DefaultHttpClientService - https://ecatserverexported:9443/api/v1/feed/machines.csv 
java.lang.Exception: Failed to access file.

This will impact performance on the RSA Security Analytics server.
In /var/lib/netwitness/uax/sa.log you will see:
Caused by: java.lang.NullPointerException 
at com.rsa.smc.sa.live.job.quartz.RecurringFeedJob.getCsvOrFeedFile(RecurringFeedJob.java:350)
ResolutionThis will be addressed in RSA Security Analytics version 10.6.3.
WorkaroundRestart Jetty:
1. SSH as root in to your SA server
2. Run:
stop jettysrv
3. Run:
start jettysrv
Repair or remove the failed feed that cannot be accessible.
1. Click on Dashboards or Administration - Select  Live and click on Feeds.
2.  Check in the list of Feeds for the failed feed(s).
3.  Use the select box to select the failed feed.
4.  Click the edit icon and use the verify button to confirm the feed is accessible.  If the feed is not accessible determine why the link to the feed is down or remove the feed by clicking on the minus delete button until you have resolved the location of the feed.