|Applies To||RSA Product Set: NetWitness|
RSA Product/Service Type: Event Stream Analysis, Concentrator
RSA Version/Condition:10.4 and above
|Issue||Issue in fetching the raw content from Concentrator. Below error can be seen when click on alert count in alerts --> summary tab --> click on alert count --> under events. |
|Resolution||Please follow the below steps in order to load the raw content in ESA:-|
1. Re-add the data source as Concentrator in ESA.
a. Open the SA Web Interface
b. Go to services and select " ESA" config page.
c. Remove the added concentrator under data sources and re-add it back.
Below is the reference link for re-adding the data source in ESA:-
2. Restart the rsa-esa service using below commands:-
#service rsa-esa stop
#service rsa-esa start
3. Navigate to the alert count again and you should be able to see raw content.