Article Content
Article Number | 000034766 |
Applies To | RSA Product Set: Security Analytics RSA Product/Service Type: SA Packet Decoder RSA Version/Condition: 10.5.x, 10.6.x |
Issue | Metadata from the traffic_flow lua parser is not getting parsed, are not found in investigations and there is an error related to the "traffic_flow_options.lua" file in /var/log/messages on the host. The error log observed in /var/log/messages is something like: Throw in function static void nw::LuaPackage::require(lua_State*, const string&) Dynamic exception type: boost::exception_detail::clone_impl std::exception::what: LUA_ERRRUN: [string "traffic_flow_options.lua"]:125: '}' expected (to close '{' at line 23) near '[' [boost::errinfo_at_line_*] = 446 module('traffic_flow_options') |
Cause | There is a syntactical error in the traffic_flow_options.lua file that prevents the file from parsing and thus prevents the parser from functioning properly. Review the log ientry from /var/log/messages: Throw in function static void nw::LuaPackage::require(lua_State*, const string&) Dynamic exception type: boost::exception_detail::clone_impl std::exception:: Line breaks have been added to the log entry for clarity. The highlighted content indicates that there is a syntactical in line 124 of the the configuration files. There may be errors on more than this line so review all lines carefully for syntax errors. Line Statement Note that lines 124 through 127 do not terminate with a comma (",") which is invalid syntax. |
Resolution | Correct the syntax error in the file and restart the nwdecoder service to read the parsers and start processing metadata.
vi /etc/netwitness/ng/parsers/traffic_flow_options.lua
restart nwdecoder Validate the changes by performing an investigation to confirm that metadata is now getting created on this appliance. |