on Mar 16, 2017Article Content
| Article Number | 000034832 |
| Applies To | RSA Product Set: NetWitness RSA Product/Service Type: Event Stream Analysis, Concentrator RSA Version/Condition:10.4 and above Platform: CentOS |
| Issue | Issue in fetching the raw content from Concentrator. Below error can be seen when click on alert count in alerts --> summary tab --> click on alert count --> under events.  |
| Resolution | Please follow the below steps in order to load the raw content in ESA:- 1. Re-add the data source as Concentrator in ESA. a. Open the SA Web Interface b. Go to services and select " ESA" config page. c. Remove the added concentrator under data sources and re-add it back. Below is the reference link for re-adding the data source in ESA:- https://community.rsa.com/docs/DOC-42319 2. Restart the rsa-esa service using below commands:- #service rsa-esa stop #service rsa-esa start 3. Navigate to the alert count again and you should be able to see raw content. |