000034689 - RSA Archer 6.1.x Queuing Service keeps crashing when trying to index Attachments in File Repository

Document created by RSA Customer Support Employee on Jan 17, 2017•Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 3Show Document
  • Comment • 0
  • View in full screen mode

Article Content

Article Number000034689
Applies ToRSA Product Set: Archer
RSA Version/Condition: 6.1
Platform: Windows Server 2012
IssueThe Queuing Service keeps crashing once a minute causing the Search Index to fall behind and not be up to date.
The Windows Application event log contains details about the Queuing Service crashing.  Here are some snippets from event log messages:
The process was terminated due to an unhandled exception.
Exception Info: System.AccessViolationException
   at ArcherTech.Services.Queuing.IFilter.GetChunk(ArcherTech.Services.Queuing.STAT_CHUNK ByRef)
   at ArcherTech.Services.Queuing.Parser.Parse(System.String, System.String)
   at ArcherTech.Services.Queuing.RepositoryContentChangeTrackingHandler.ProcessMessage(ArcherTech.Services.IndexingService.RepositoryContentChangeTrackingMessage)

Faulting application name: Archer.Services.Queuing.exe, version: 6.1.0.1159, time stamp: 0x573f501c
Faulting module name: glcndFilter.dll, version: 6.3.9600.18229, time stamp: 0x56b4b651
CauseWhen Microsoft released security update MS16-028 for Windows Server 2012 R2, they incorporated additional security for specially crafted PDF files, including password protected PDFs. This removed the ability for the Queuing Service to access and index these types of files.
ResolutionTo resolve the issue, you must upgrade to RSA Archer 6.1 P1 HF1 (6.1.0.1.1) or 6.1 P2 HF1 (6.1.0.2.1).
Workaround

Identify the Attachment files in the File Repository causing the Queuing service to crash


  1. Download the Windows Sysinternals Process Monitor to the server running the Queuing Service.
  2. From the server running the Queuing Service, run the Process Monitor tool as Administrator.
  3. Add the Filters shown below and enable the File System Activity option.  
  4. Adjust the File Repository path to match your environment.
User-added image


  1. When the file is identified, take note of the file name in the path.  In the following image, the file name is 10.msg which means the file id is 10. In the file repository, the filename before the suffix is the file id.
     User-added image



  2. Run the following SQL command to identify the record containing the Attachment file after replacing ### in the last line of the statement with the file id from step 5.


    SELECT l.module_id, mt.module_name, l.level_id, lt.level_name, rl.content_id AS ContentID, fd.field_id, ft.field_name, rf.file_id,
    REVERSE(STUFF(REVERSE(rf.file_name),CHARINDEX('.',REVERSE(rf.file_name))+1,LEN(REVERSE(rf.file_name)),REVERSE(rf.file_id))) AS Archer_FileName, 
    rf.file_name AS Actual_FileName, rf.file_length / 1024 AS SizeKB, rf.download_cnt 
    FROM tblXIVContentRepositoryLinks(NOLOCK) rl 
    JOIN tblRepositoryFile(NOLOCK) rf ON rl.file_id = rf.file_id 
    JOIN tblIVFieldDef(NOLOCK) fd ON fd.field_id = rl.field_id 
    JOIN tblFieldTranslation(NOLOCK) ft ON ft.field_id = fd.field_id 
    JOIN tblLevel(NOLOCK) l ON l.level_id = fd.level_id
    JOIN tblModule(NOLOCK) m ON m.module_id = l.module_id
    JOIN tblLevelTranslation LT(NOLOCK) ON L.level_id = LT.level_id 
    JOIN tblModuleTranslation MT(NOLOCK) ON MT.module_id = m.module_id 
    WHERE ft.language_id = 1
    AND rf.file_id = ###

    User-added image


  3. Based on the SQL results, go to the content record and remove the file from the field.
  4. Move or delete the file from the File Repository so the Queuing Service will stop trying to index it. 

Attachments

    Outcomes