Skip to content
  • There are no suggestions because the search field is empty.

NetWitness Reporting Engine displays the error 'terminated with status 255' and must be reinitialized

Issue

Reporting Engine displays the error "terminated with status 255" and must be reinitialized.

After attempting to start the Reporting Engine service with 'systemctl start rsasoc_re', the Reporting Engine service immediately terminates.

The following error messages are found in /var/log/messages:

Jul  8 07:24:03 saserver init: rsasoc_re main process (22779) terminated with status 255
Jul  8 07:24:03 saserver init: rsasoc_re main process ended, respawning
Jul  8 07:24:36 saserver init: rsasoc_re main process (22880) terminated with status 255
Jul  8 07:24:36 saserver init: rsasoc_re main process ended, respawning
Jul  8 07:25:09 saserver init: rsasoc_re main process (22972) terminated with status 255
Jul  8 07:25:09 saserver init: rsasoc_re main process ended, respawning
Jul  8 07:25:35 saserver init: rsasoc_re main process (23089) terminated with status 255
Jul  8 07:25:35 saserver init: rsasoc_re main process ended, respawning
Jul  8 07:25:55 saserver init: rsasoc_re main process (23222) terminated with status 255
Jul  8 07:25:55 saserver init: rsasoc_re main process ended, respawning
Jul  8 07:26:16 saserver init: rsasoc_re main process (23349) terminated with status 255
Jul  8 07:26:16 saserver init: rsasoc_re respawning too fast, stopped

Resolution

At times there is a need to reinitialize the Reporting Engine service if it refuses to run (perhaps due to some file/database corruption).

Note: Another knowledge base article may assist, such as How to backup and restore the RSA Security Analytics Reporting Engine, for selective and complete restore from backup.

WARNING: This should only be done as a last resort after you have exhausted all other troubleshooting steps as it will cause data loss (you will lose all your configured rules, alers, charts etc in the Reporting Engine).
This effectively re-installs the Reporting Engine service.

 

Steps to re-initialize the Reporting Engine
 

  1. Stop Reporting Engine service:
#systemctl stop rsasoc_re
  1. Stop jetty service:
#systemctl stop jetty
  1. Remove existing Reporting Engine cache in /tmp:
#rm -rf /tmp/reporting-engine*
  1. Rename the existing Reporting Engine working directory:
mv /home/rsasoc/rsa/soc/reporting-engine /home/rsasoc/rsa/soc/reporting-engine.old
  1. Check that /opt/rsa/soc/reporting-engine/conf/cent5/init.d/reporting-engine exists
  2. Start jetty Service:
systemctl start jetty
  1. Run /opt/rsa/soc/reporting-engine/bin/setup.sh
  2. Re-start Reporting Engine service:
systemctl start rsasoc_re
 

The above steps have worked for some customers.

Internal Comments

UserName:shurtj
8/12/2014 1:54:09 PM - Updated Article
Updated article and made changes to abide by Primus best practices.

UserName:mccotl
10/15/2014 3:23:26 AM - Updated Article
Modified article to change log entries to become a symptom. Added cross reference to a68239 and set the warning to red to hi-light that this a procedure or last resort.

Mohamed Hegab - 8 April 2024
  • Changed article name to "NetWitness Reporting Engine displays the error 'terminated with status 255' and must be reinitialized"
  • replaced RSA with Netwitness
  • Updated the commands to restart the service
Mohamed Hegab - 16 May 2024
Requesting archive of article as it no longer applies to current version.

Product Details

NetWItness Product Set: NetWitness Platform
NetWItness Product/Service Type: Reporting Engine
NetWItness  Version/Condition: 11.x, 12.x
Platform: CentOS 7 / Alma

Approval Reviewer Queue

Technical approval queue