- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
SA Fails to export pcap/Overall broker slowness/Wierdness/PIA
I've been running in to a problem using the web interface and actually getting data to export in to a pcap.
it seems that more often then not, my pcap exports will fail from the web UI, but using the fat client i am able to retrieve the data.
In the web interface the amount of sessions seems to be irrelevant, as well as what data source i am selecting(broker vs concentrator)
this has existed for me since the upgrade to 10.3sp1( or there abouts) and i'm currently running 10.3.3.2517, and its still persisting.
RSA people, any ideas?
-mark
- Tags:
- Community Thread
- Discussion
- export
- fatclient
- Forum Thread
- NetWitness
- NW
- NWP
- pcap
- RSA NetWitness
- RSA NetWitness Platform
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
Hi Mark,
I haven't seen this reported yet. Let me take the screen cap and the errors and get them into our folks to see what happening (or not happening as the case may be).
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
Hey Mark- How many sessions are you trying to export? (for the failed instances)
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
the amount of sessions seems to be irrelevant, but i have verified that even with the fat client exports will fail when attempting to do them through the broker. ( which kinda defeats the purpose of the broker)
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
Gotcha Mark. I've created a ticket for our engineers inkling your symptoms, versions, and screenshot. Feel free to ping me directly if you have any more data I should provide to the team or just have questions in general regarding this issue. michael.shreve@rsa.com
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
michael,
thanks for the help i have emailed some additional data.
mark
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
it's bug, i have the same issue, opened case with support but no update yet. It's due to the hotfix issue.
you need to downgrade to 10.3.2(replace with the old NwBroker file or install rpm) . Or you can export using the navigate view.
If you downgrade, you cannot connect broker to broker.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
Patriot- do you have a number on that ticket so I can combine the two and light fire where appropriate?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
another "feature" I've noticed with the broker is the fact that it likes to hold sessions open/active for quite a while, in looking through the system info under devices, i have sessions still showing that where opened yesterday morning/afternoon.
is there a setting within the explorer config or else where that can correct this?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
case id: 00471224
