000035351 - RSA NetWitness Endpoint Live Connect Threat Intelligence Fails to Initialize or Live Connect: Unexpected condition error is seen

Document created by RSA Customer Support Employee on Aug 24, 2017
Version 1Show Document
  • View in full screen mode

Article Content

Article Number000035351
Applies ToRSA Product Set: ECAT
RSA Product/Service Type: ECAT
RSA Version/Condition: 4.3.0.2, 4.3.0.3
Platform: Windows
 
IssueLive Connect Threat Intelligence fails to initialize during startup, or there is a connection issue with the site itself to connect and download Live Connect data. Sample errors seen:
  1. WARNING: System.ComponentModel.WarningException: LiveConnect: Unexpected condition while preparing download request from server
    • Indicates 500 errors where the website is actually down
  2. Live Connect is disabled
    • Indicates that the service is disabled in the UI
  3. Error message indicating the Live Connect service failed to initailize
    • This error is not available here(needs update) but indicates that the thread to start the Live Connect service failed to initialize
CauseEach cause is related to a different issue that is preventing the Live Connect service from running. Below these are:
  1. Website itself is experiencing connection issues. Sample error for clarification: [Auto Restart (StartLiveConnectClient)] ERROR - [10] System.Net.WebException:The remote server returned an error: (500) Internal Server Error.
  2. The service is simply stopped in the UI.
  3. This is related to a known bug which results in the thread to manage the Live Connect settings to fail, making it impossible to start the Live Connect service and run it correctly. This bug is version specific to 4.3.0.2 and 4.3.0.3

 
ResolutionDepending on the 3 errors seen, the remediations are shown below:
  1. If the website is actually down and connections are unavailable, engineering must restart or resolve the connection issues with the site. Please request assistance from support to contact engineering for the server issues.
  2. Just having a message indicating the Live Connect service is stopped simply shows the service is turned off. Simply enabling it in the UI will give Live Connect state changed, following which the service will resume. NOTE: if the site is down, or the service is unable to connect, enabling the service will cause a large number of WARNING messages to appear in the service output.
  3. See issue and cause for the unexpected condition error message. Solution is to upgrade from 4.3.0.2 or 4.3.0.3 to 4.3.0.4 which has the fix.

Attachments

    Outcomes