Skip to content
  • There are no suggestions because the search field is empty.

Creating a custom feed in RSA NetWitness Platform using xml file fails

Issue

Creating a new Custom Feed using xml file results in failure.

While uploading the Feed as per below.

User-added
 

It shows that the Status is Failed as it is waiting on the LogDecoder Service.

User-added
 

For the LogDecoder /var/log/messages shows no errors and nothing to confirm that is done also.

But for SA.log on SA it shows below error:  

2020-05-01 15:36:46,689 [org.springframework.scheduling.quartz.SchedulerFactoryBean#0_Worker-6] ERROR com.rsa.smc.sa.core.job.NextGenUploadFileJob - An error occurred while uploading feed to service
java.lang.Exception: Unrecognized string format
at com.rsa.smc.sa.core.service.impl.CarlosCoreMessageService.upload(CarlosCoreMessageService.java:1076)
at com.rsa.smc.sa.core.service.impl.CarlosCoreMessageService.upload(CarlosCoreMessageService.java:1051)
at jdk.internal.reflect.GeneratedMethodAccessor2784.invoke(Unknown Source)
at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.base/java.lang.reflect.Method.invoke(Method.java:566)
at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:333)
at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:190)

at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:157)
at org.springframework.aop.aspectj.MethodInvocationProceedingJoinPoint.proceed(MethodInvocationProceedingJoinPoint.java:84)
at com.rsa.smc.sa.common.nextgen.security.NwLegacyAuthenticationAspect.switchAuthentication(NwLegacyAuthenticationAspect.java:96)
at jdk.internal.reflect.GeneratedMethodAccessor393.invoke(Unknown Source)
at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.base/java.lang.reflect.Method.invoke(Method.java:566)
at org.springframework.aop.aspectj.AbstractAspectJAdvice.invokeAdviceMethodWithGivenArgs(AbstractAspectJAdvice.java:627)
at org.springframework.aop.aspectj.AbstractAspectJAdvice.invokeAdviceMethod(AbstractAspectJAdvice.java:616)
at org.springframework.aop.aspectj.AspectJAroundAdvice.invoke(AspectJAroundAdvice.java:70)
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:168)
at org.springframework.aop.interceptor.ExposeInvocationInterceptor.invoke(ExposeInvocationInterceptor.java:92)
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179)
at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:213)
at com.sun.proxy.$Proxy186.upload(Unknown Source)
at com.rsa.smc.sa.core.job.NextGenUploadFileJob.executeJob(NextGenUploadFileJob.java:183)
at com.rsa.netwitness.carlos.scheduling.jobs.AbstractJob.execute(AbstractJob.java:61)
at org.quartz.core.JobRunShell.run(JobRunShell.java:202)
at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:573)
2020-05-01 15:36:46,696 [org.springframework.scheduling.quartz.SchedulerFactoryBean#0_Worker-6] INFO org.quartz.core.JobRunShell - Job admin.533e6e20-bc0c-488e-a675-d84cbf9533aa threw a JobExecutionException:
org.quartz.JobExecutionException: Error uploading file to service
at com.rsa.smc.sa.core.job.NextGenUploadFileJob.checkForFailedUpload(NextGenUploadFileJob.java:289)
at com.rsa.smc.sa.core.job.NextGenUploadFileJob.executeJob(NextGenUploadFileJob.java:210)
at com.rsa.netwitness.carlos.scheduling.jobs.AbstractJob.execute(AbstractJob.java:61)
at org.quartz.core.JobRunShell.run(JobRunShell.java:202)
at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java

Cause


This was because of the CSV file format containing spaces as below:

serv1 , 192.168.10.2
serv2 , 192.168.10.3
serv3 , 192.168.10.4
serv4 , 192.168.10.5
serv5 , 192.168.10.6

Caution: In order to confirm that there are spaces in the csv file, copy the csv file in a .txt file.

Resolution

The csv file should be adjusted in text format and remove the whitespaces as below:

serv1,192.168.10.2
serv2,192.168.10.3
serv3,192.168.10.4
serv4,192.168.10.5
serv5,192.168.10.6


Product Details

RSA Product Set: NetWitness Platform
RSA Product/Service Type: Custom Feeds.
RSA Version/Condition: 11.x.
Platform: CentOS 7 

Approval Reviewer Queue

RSA NetWitness Suite Approval Queue