SA 10.5 - Multiple entries in Index-Concentrator-Custom File causes Initialization Error: "Cannot have more than one root element, trying to add 'key' when 'key' already exists"
4 years ago
Originally Published: 2015-06-22
Article Number
000063078
Applies To
Security Analytics Concentrator 10.5
Issue

When trying to add more than one entry in the index-concentrator-custom.xml file, the following errors appear in /var/log/messages : 

NWAPPLIANCE18030 nw[4636]: [Engine] [warning] Module concentrator failed to load: /etc/netwitness/ng/index-concentrator-custom.xml - Cannot have more than one root element, trying to add 'key' when 'key' already exists
NWAPPLIANCE18030 nw[4636]: [Engine] [warning] Module concentrator failed to load: Diagnostic information: Throw in function static void nw::LanguageManager::loadLanguageExtensions(const string&, nw::LanguagePtr)Dynamic exception type: N5boost16exception_detail10clone_implIN2nw8XmlErrorEEEstd::exception::what: /etc/netwitness/ng/index-concentrator-custom.xml - Cannot have more than one root element, trying to add 'key' when 'key' already exists[PN5boost16errinfo_at_line_E] = 388​

Cause
These errors occur when the index-concentrator-custom.xml file is not formatted properly. 
Resolution
The following steps will need to be performed to resolve the issue: 
  1. Back up the existing index-concentrator-custom.xml file
  2. Replace the contents of the file with the provided template
  3. Append contents of backup to provided template
  4. Restart concentrator service
Workaround
The index-concentrator-custom.xml file will need to be modified to be in a valid XML format. Perform the following steps: 
  1. Go to Administration>Services
  2. Select the concentrator then go to view>config and select files
  3. From the left drop-down menu select index-concentrator-custom.xml 
  4. **Select everything in this file and copy it to a safe location (like a .txt file on your local desktop)**
  5. After you have safely backed-up your file, you will now need to overwrite it with the following template: 
<?xml version="1.0" encoding="utf-8"?>
<language level="IndexValues" defaultAction="Auto">
<!-- *** Please insert your custom keys or modifications below this line *** -->

</language>
  1. Add the XML code lines that you backed up below the line noted in the template above. Your finished product should look similar to the following example: 
<?xml version="1.0" encoding="utf-8"?>
<language level="IndexValues" defaultAction="Auto">
<!-- *** Please insert your custom keys or modifications below this line *** -->

<key description="Bytes" format="UInt64" level="IndexValues" name="bytes" valueMax="250000" defaultAction="Open"/>
<key description="Business Network" format="Text" level="IndexValues" name="business" valueMax="1000" defaultAction="Open"/>

</language>
  1. Stop the concentrator capture by going to Administration>Services, selecting the concentrator view>system and then selecting Stop Aggregation. This process may take a few minutes. You will know when it is completed when the Start Aggregation button is not longer grayed out.  
  2. Restart the concentrator service by going to Administration>Services, selecting the concentrator view>system and then selecting Shutdown Service. Selecting Shutdown Service will stop the concentrator service and then automatically restart it.

Related Articles

Trending Articles

Don't see what you're looking for?