000034792 - Corrupt or incomplete HTML session during event reconstruction on RSA Netwitness

Document created by RSA Customer Support Employee on Feb 23, 2017Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 3Show Document
  • View in full screen mode

Article Content

Article Number000034792
Applies ToRSA Product Set: Security Analytics
RSA Product/Service Type: SA Security Analytics UI
RSA Version/Condition: 10.5.x, 10.6.x
IssueWhen attempting to view larger sessions the images are not rendering, instead during event reconstruction we see a corrupt or incomplete session and the text content limited:
Event Reconstruction "Corrupt or incomplete HTML session"
You will see something similar to this in /var/lib/netwitness/uax/sa.log on the Security Analytics server:
INFO  com.rsa.smc.sa.investigation.reconstruction.domain.builder.ContentBuilder - 
ContentBuilder#stageBuild: reached max packet limit 100 for session 1672351202;
stopping reconstruction

CauseThe session has reached the max packet limit for the session. Limits on the number of packets per session is configured by default to enhance performance in multi-user environments where reconstruction of events are frequently being accessed.
ResolutionAdjust the event reconfiguration settings according to your environment and resources to render the full session.
This can be configured from RSA Security Analytics:
1. Click on Administration from RSA Security Analytics
2. Select System
3. From the left pane click on Investigation
4. Click on the Events tab
5. Scroll down to the Reconstruction Events Settings and adjust these settings to meet the needs and resources for your environment.
Reconstruction Settings
As a reference the configuration for these settings are defined in the document below: