Live: Troubleshooting

Document created by RSA Information Design and Development on Oct 11, 2017Last modified by RSA Information Design and Development on Nov 6, 2017
Version 5Show Document
  • View in full screen mode
  

This section provides troubleshooting instructions for issues faced when using the Live Services module in NetWitness Suite.

Troubleshooting OutOfMemoryError on Contexthub Server

This section provide troubleshooting instructions when you encounter OutOfMemoryError on Context Hub server and the service becomes unresponsive.

If there are any TAXII feeds configured, Health and Wellness raises alerts when the available heap memory of Context Hub server is critically low. If the status of Context Hub server is Unhealthy because of low memory, perform the following:

  1. Make sure that the feeds Start Date is within 180 days.

  2. Check if any TAXII feed is consuming too much disk space. A TAXII feed can consume maximum of 300 MB. If it consumes more disk space, you must reduce the value in the Remove STIX data older than field under Advanced Options in the Custom Feed Creation Wizard when you edit a TAXII feeds.

Note: If the issue still persists, you must execute step 3.

  1. Decrease the number of parallel threads available for processing STIX, perform the following:
    1. Go to ADMIN > Services > Context Hub service > View > Explore.
    2. In the tree panel, navigate to enrichment/stix/ config.
    3. In the right panel, set the stix-query-scheduler-pool-size field value to 2. By default the value is 5. This setting controls how many number of threads are allowed to process queries for STIX data at the same time.
    4. Set the taxii-poll-scheduler-pool-size field value to 2. By default the value is 5. This setting controls how many number of threads are allowed to poll TAXII servers at the same time.
    5. Restart the Context Hub server.
Next Topic:References
You are here
Table of Contents > Troubleshooting

Attachments

    Outcomes