000026696 - How to preform a Summary DB size adjustment in an RSA NetWitness concentrator

Document created by RSA Customer Support Employee on Jan 10, 2017Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 3Show Document
  • View in full screen mode

Article Content

Article Number000026696
Applies ToRSA NetWitness NextGen
RSA NetWitness Concentrator
IssueHow to preform a Summary DB size adjustment in an RSA NetWitness concentrator.
Resolution

Default configuration on Series 2 Concentrators set the summary database to exceed the size of physical memory of the appliance.  Once the index summary database grows beyond the size of physical memory it causes queries to take a long time to return or simply hang and eventually time out. 

Please note that this problem does not affect Series 3 Concentrators, therefore this solution does not apply to them.


To alleviate this issue it has been determined the summary database size needs to be reduced to half the size of physical memory. Once the size is reduced the Concentrator will require a data reset for the change to be implemented and for immediate performance improvement. If there is a broker in the environment then it will require a data reset once all the Concentrators have been configured and reset.

Follow these steps to implement the summary database re-size on all the concentrators in the environment:

1. Connect to the Concentrator in Administrator.
2. Right click over the Concentrator icon in the 'Services' list and select 'Explorer'.
3. In the tab that opens to the right navigate to /index/config.
4. Locate the summary.dir entry and change the number after the equal sign to 16384.

eg. /var/netwitness/concentrator/index/summary.db=16384

5. Select the /concentrator folder.
6. Right click over the concentrator folder and select 'Properties'.
7. In the frame which opens to the bottom right select 'reset' in the pull down menu.
8. Enter 'data=1' in the 'Parameters' field and click 'Send'.

Follow these steps to data reset the broker after all the concentrator summary database sizes have been adjusted:

1. Connect to the Broker in Administrator.
2. Right click over the Broker icon in the 'Services' list and select 'Explorer'.
3. In the tab that opens select the /concentrator folder.
4. Right click over the concentrator folder and select 'Properties'.
5. In the frame which opens to the bottom right select 'reset' in the pull down menu.
6. Enter 'data=1' in the 'Parameters' field and click 'Send'.

The Concentrator/Broker will reset its data, perform a service restart, and reconsume all meta data from the devices in its aggregation list.

a59720ResizeSummaryDB.pdf

Legacy Article IDa59720

Attachments

    Outcomes