[Archive] Aggregation failed to start on Concentrator with the error Message start was not recognized by /concentrator in RSA Security Analytics

Issue

After a restart of a Concentrator, aggregation fails to start and the error message below is displayed.

 Aggregation failed to start.: Failed to process message start for /concentrator 
 
com.rsa.netwitness.carlos.transport.TransportException: Message start was not recognized by /concentrator

Resolution

This is to be expected and the product is functioning as designed.
It happens not only when rebooting the appliance, but if when restarting the services (concentrator) also.

When watching that appliance in the Health and Wellness portion of the UI and looking when the service is coming up, it takes some time before the aggregation actually starts because it is “initializing databases” and “initializing the SDK” so as soon as everything is initialized properly, the aggregation starts.

Product Details

RSA Product Set: Security Analytics
RSA Product/Service Type: Concentrator
RSA Version/Condition: 10.4.0.x, 10.5.x
Platform: CentOS
O/S Version: EL6

Approval Reviewer Queue

Technical approval queue