Skip to content
  • There are no suggestions because the search field is empty.

'Failed to retrieve meta keys' has occurred intermittently error is RSA NetWitness Logs & Network 11.1.0.0

Issue

Not only 'Failed to retrieve meta keys.' from Navigate tab, but also 'Failed to retrieve content' from Event Reconstruction.

User-added User-added
Following messages occurred in /var/lib/netwitness/uax/logs/sa.log
2018-07-03 06:48:45,849 [Simple Background Task 1506254033] TRACE com.rsa.netwitness.carlos.clients.nextgen.nw.NwClientPipeBase - Ping 192.168.20.164 56001 [411669]
2018-07-03 06:48:48,055 [Simple Background Task 1506254033] TRACE com.rsa.netwitness.carlos.clients.nextgen.nw.NwClientPipeBase - Ping 192.168.20.160 56006 [3150]
2018-07-03 06:48:48,342 [NioProcessor-15195] DEBUG com.rsa.netwitness.carlos.clients.nextgen.nw.NwClientPipeBase - Received message for non-existent route [15011645, 15020130, 15020139, 119]
2018-07-03 06:48:48,342 [NioProcessor-15195] DEBUG com.rsa.netwitness.carlos.clients.nextgen.nw.NwClientPipeBase - Received message for non-existent route [15011645, 15020092, 15020101, 119]

Resolution

The ping timeout can be configured through a carlos property: -Dcarlos.soTimeout
1. Add the -Dcarlos.soTimeout=7200 to java options under /etc/default/jetty
2. Then restart jetty.

Product Details

RSA Product Set: NetWitness Logs & Network
RSA Product/Service Type: Security Analytics Server
RSA Version/Condition: 11.1.0.0
Product Name: SA-S4H-AS
Product Description: Series4S HeadUnit-Anlytics Svr 10 User

Approval Reviewer Queue

RSA NetWitness Suite Approval Queue