Skip to content
  • There are no suggestions because the search field is empty.

NetWitness Concentrator Initialization Error with mutliple entries in index-concentrator-custom.xml with error Cannot have more than one root element, trying to add 'key' when 'key' already exists

Issue

When trying to add more than one entry in the index-concentrator-custom.xml file, the following errors appear in /var/log/messages : 

NWAPPLIANCE18030 nw[4636]: [Engine] [warning] Module concentrator failed to load: /etc/netwitness/ng/index-concentrator-custom.xml - Cannot have more than one root element, trying to add 'key' when 'key' already exists
NWAPPLIANCE18030 nw[4636]: [Engine] [warning] Module concentrator failed to load: Diagnostic information: Throw in function static void nw::LanguageManager::loadLanguageExtensions(const string&, nw::LanguagePtr)Dynamic exception type: N5boost16exception_detail10clone_implIN2nw8XmlErrorEEEstd::exception::what: /etc/netwitness/ng/index-concentrator-custom.xml - Cannot have more than one root element, trying to add 'key' when 'key' already exists[PN5boost16errinfo_at_line_E] = 388​

Cause

These errors occur when the index-concentrator-custom.xml file is not formatted properly. 

Resolution

The index-concentrator-custom.xml file will need to be modified to be in a valid XML format. Perform the following steps to resolve initialization error.
  1. Go to Administration>Services
  2. Select the concentrator then go to view>config and select Files tab.
  3. From the left drop-down menu select index-concentrator-custom.xml 
  4. **Select everything in this file and copy it to a safe location (like a .txt file on your local desktop)**
  5. After you have safely backed-up your file, you will now need to overwrite it with the following template: 
<?xml version="1.0" encoding="utf-8"?>
<language level="IndexValues" defaultAction="Auto">
<!-- *** Please insert your custom keys or modifications below this line *** -->

</language>
  1. Add the XML code lines that you backed up below the line noted in the template above. Your finished product should look similar to the following example: 
<?xml version="1.0" encoding="utf-8"?>
<language level="IndexValues" defaultAction="Auto">
<!-- *** Please insert your custom keys or modifications below this line *** -->

<key description="Bytes" format="UInt64" level="IndexValues" name="bytes" valueMax="250000" defaultAction="Open"/>
<key description="Business Network" format="Text" level="IndexValues" name="business" valueMax="1000" defaultAction="Open"/>

</language>
  1. Stop the concentrator Aggregation by going to Administration>Services, selecting the concentrator view>system and then selecting Stop Aggregation. This process may take a few minutes. You will know when it is completed when the Start Aggregation button is not longer grayed out.  
  2. Restart the concentrator service by going to Administration>Services, selecting the concentrator view>system and then selecting Shutdown Service. Selecting Shutdown Service will stop the concentrator service and then automatically restart it.

Product Details

NetWitness Product Set: NetWitness Platform
NetWitness Product/Service Type: Concentrator
NetWitness Version/Condition: 12.X
Platform: CentOS 7 / Alma

Summary

This article details what causes and how to correct the following errors on a concentrator: Cannot have more than one root element, trying to add 'key' when 'key' already exists.


Approval Reviewer Queue

Technical approval queue