How to Troubleshoot-Hourly Processing is Not Working Properly in RSA Web Threat Detection 5.1
Originally Published: 2016-11-30
Last Modified: 2023-10-06
Article Number
Applies To
RSA Product/Service Type: Forensics
RSA Version/Condition: 5.1
Platform: Linux
Issue
Resolution
1. Determine if there were any changes in WTD configuration, or networking or OS environment.
2. Go to the VARZ grapher and look at the message flow across the components from
Silvertap to Front Plex to SilverSurfer to Back Plex to Mitigator to Alert plex to Alert Server and Organizer
Note:
- Each of these are separate components/processes that take their messages off the Back Plex.
- Issues with Silvertap may need Customer Networking team to verify that the connection from network hardware to the Silvertap is working properly.
- Identify places where the message flow has stopped or the message queue has increased.
- Note CPU and Memory usage with these identified components that are showing problems.
A. Go to /var/log/messages and look for error and var/log/silvertail/ for component log
B. Look at top -H in the console for WTD processes that are consuming large memory and cpu cycles.
C. Consider a restart if there are no errors seen above.
B. Look at top -H in the console for WTD processes that are consuming large memory and cpu cycles.
C. Consider a restart if there are no errors seen above.
5. Observe results of a restart of services, or if issues are persisting contact Customer Support for further assistance.
6. Go to var/opt/silvertail/data/tasks and /indexer folders and make sure the completed folders of each are empty.
6. Go to var/opt/silvertail/data/tasks and /indexer folders and make sure the completed folders of each are empty.
Note: If still having an issue consider contacting Customer Support for further assistance.
Notes
Related Articles
AFX Server stuck in 'Not running' State, with error 'timed out waiting for AFX applications to start' Number of Views Unable to Resolve User by Login ID and/or Alias or Authenticator Not Assigned to User When Attempting to Authenticate via … Number of Views How to Request Access to the RSA Authentication Manager AMI for AWS via RSA Support Number of Views Authentication Manager How to Retrieve the LDAPS Certificate and Configure an External Identity Source to Use LDAPS Number of Views
Trending Articles
RSA SecurID software token .sdtid file fails to import into RSA SecurID Software Token 5.0 for Windows How to manipulate imported RSA SecurID Software Token(s) on an iPhone or iPad device Authentication Manager Security Console and Operations Console Inaccessible After Certificate Update RSA MFA Agent 2.3.6 for Microsoft Windows Installation and Administration Guide How to 'Trust' the RSA Authentication Manager Security Console Self-Signed Root CA certificate and prevent Cert warnings.
Don't see what you're looking for?
