Jan 24 18:08:03 avsesa-rsasa-pkt-p01 nw: [Index] [failure] Unexpected Query Exception of type N5boost12interprocess22interprocess_exceptionE: Too many open files
Any ideas? This is what happens when I try to use investigator.
- Community Thread
- Forum Thread
- RSA NetWitness
- RSA NetWitness Platform
Okay, looks like you are missing the line. See my comment above and add it to your file(s).
Alternatively, you can do:
For versions 10.3.1 and higher.
Yes, 10.3 Indexing is way different and on the log side the reindexing will take days on a large deployment.
Even in Development the system took over night to catch up after reindexing.
I'm concerned about my production environment where there is far much more data and potentially reindexing is going to take days?
Reindexing? There's no reindexing needed when upgrading from 10.2 to 10.3. There's a conversion process that takes a few minutes on a decoder and a few hours (at most, if it's really large) on a concentrator.
In a few isolated cases, especially in the case of a misconfigured index on a decoder, a reindex was required. On a Decoder, this reindex takes a few hours.
I'm not talking packets. I specifically talking logs and yes the system took overnight to catch up.
And if you look at the concentrator through the config view you will see a huge backlog of meta that the concentrator must catch up on.
So, not sure what this exactly is?
It would be extremely helpful to explain this level of detail in the release notes.
For example, in 10.2 the indexing was changed for these reasons.