000036389 - RSA NetWitness Endpoint upgrade from 4.3.x is taking too long to complete

Document created by RSA Customer Support Employee on Sep 15, 2018
Version 1Show Document
  • View in full screen mode

Article Content

Article Number000036389
Applies ToRSA Product Set: ECAT, NetWitness Endpoint
RSA Product/Service Type: Server, SQL Database
RSA Version/Condition: 4.3.x, 4.4.x
Platform: Windows, Microsoft SQL Server
IssueThe RSA NetWitness Endpoint upgrade from 4.3.x is taking more than an hour to complete during the SQL update.

The installer program in Windows Task Manager shows that the program is "Not Responding."

The installer log file "%temp%\Setup Log {date} #001.txt" does not show any error at the end of the file. It shows the SQL script ECAT_DELTA_4304_LATEST.SQL is running and occasionally the log file is updated showing the line below, where the number [275] is line last updated and the result code [0] indicates there is no error.

sectionLine [275] Result [0]
CauseThere is a known issue where the mocNetAddresses database table can grow to be very large and the database maintenance job doesn't delete the old records.

To confirm if a very large mocNetAddresses database table is the issue for the upgrade, run the SQL queries below in the ECAT$PRIMARY database by selecting New Query in SQL Server Management Studio.
  • If the mocNetAddresses database table has 10s million rows marked to delete or over 80% of the rows in this database table are marked to delete, then the upgrade will be adversely extended.

    USE ECAT$PRIMARY
    GO
    DECLARE @countOfAll  FLOAT(8)
    SELECT @countOfAll = COUNT(*) FROM mocNetAddresses
    SELECT
    COUNT(*) AS RowsMarkedToDelete, COUNT(*) / @countOfAll * 100 AS PercentMarkedToDelete
    FROM mocNetAddresses
    WHERE MarkedAsDeleted = 1

  • If the mocNetAddresses database table has 10s million rows and uses 10s GB disk space then the upgrade will be adversely extended.

    USE ECAT$PRIMARY
    GO
    sp_spaceused '[dbo].[mocNetAddresses]'

ResolutionThe known issue referenced in this article has been permanently fixed in RSA NetWitness Endpoint version 4.4.0.2 and above.
WorkaroundDepending on whether or not you will be upgrading to a fixed version in the short-term, there are two workarounds that can be performed to alleviate the issue until an upgrade can be performed.
 
Please contact RSA Customer Support and reference this article and they will be able to assist in performing the appropriate workaround.

Attachments

    Outcomes