000011917 - Can't access an RSA NetWitness appliance due to 'openWorker error Too many open files' messages

Document created by RSA Customer Support Employee on Jan 10, 2017Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 2Show Document
  • View in full screen mode

Article Content

Article Number000011917
Applies ToRSA NetWitness NextGen
RSA NetWitness Decoder
RSA NetWitness Log Decoder
RSA NetWitness Concentrator
RSA NetWitness Hybrid
RSA NetWitness Broker
RSA NetWitness Administrator
IssueCan't access an RSA NetWitness appliance due to "openWorker error Too many open files" messages.
Unable to access your RSA NetWitness appliance via RSA NetWitness Administrator.

Errors similar to the following are observed in the /var/log/messages file:

Aug  2 21:43:46 NWB-001 nw[31660]: [Engine] [failure] openWorker error Too many open files at NwUtils/FileStreamLinux.cpp:246 using file: /var/netwitness/broker/index/master.nwindex flags 0x0241

The Netwitness process will need to be restarted before gaining access to the system.

ResolutionBefore  restarting the service connect via SSH and run the following command:

  ps -ef | grep -i nw

Note the PID of the process in question (ie nwbroker nwconcentrator, nwdecoder) Then run the following..

  ls -l /proc/$PID/fd

Where $PID is the process id of the service (Broker, Concentrator, Decoder). Paste the output of the directory listing in a support case for root cause analysis.

Once that information has been collected and provided to support, restart the process by using the stop/start command

  stop (nwbroker nwconcentrator, nwdecoder) or monit stop
(nwbroker nwconcentrator, nwdecoder)
  start (nwbroker nwconcentrator, nwdecoder) or monit start (nwbroker nwconcentrator, nwdecoder)

You should now be able to access the appliance via NetWitness administrator.
Legacy Article IDa58666