Skip to content
  • There are no suggestions because the search field is empty.

NetWitness UEBA userId_hourly_ueba_flow DAG fails with the error: No converter found capable of converting from type [java.lang.Integer] to type [java.util.Date]

Issue

After upgrading to 12.5.1.0, the UEBA userId_hourly_ueba_flow DAG fails repeatedly with the following this error in the following log: 

/var/log/netwitness/presidio/3p/airflow/logs/userId_hourly_ueba_flow/hourly_output_processor/2024-12-23T09:00:00+00:00/1.log

[2024-12-23 10:25:13,761] {bash_operator.py:157} INFO - 2024-12-23T10:25:13.758Z ERROR 3705220 --- [output-processor] [12-23T09:00:00Z] p.o.p.services.OutputExecutionService : Failed to run the output processor due to
[2024-12-23 10:25:13,761] {bash_operator.py:157} INFO -
[2024-12-23 10:25:13,761] {bash_operator.py:157} INFO - java.util.concurrent.CompletionException: org.springframework.core.convert.ConverterNotFoundException: No converter found capable of converting from type [java.lang.Integer] to type [java.util.Date]
[2024-12-23 10:25:13,761] {bash_operator.py:157} INFO - at java.base/java.util.concurrent.CompletableFuture.encodeThrowable(CompletableFuture.java:315)
[2024-12-23 10:25:13,761] {bash_operator.py:157} INFO - at java.base/java.util.concurrent.CompletableFuture.completeThrowable(CompletableFuture.java:320)
[2024-12-23 10:25:13,761] {bash_operator.py:157} INFO - at java.base/java.util.concurrent.CompletableFuture$AsyncRun.run(CompletableFuture.java:1807)
[2024-12-23 10:25:13,761] {bash_operator.py:157} INFO - at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
[2024-12-23 10:25:13,761] {bash_operator.py:157} INFO - at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
[2024-12-23 10:25:13,761] {bash_operator.py:157} INFO - at java.base/java.lang.Thread.run(Thread.java:840)
[2024-12-23 10:25:13,761] {bash_operator.py:157} INFO - Caused by: org.springframework.core.convert.ConverterNotFoundException: No converter found capable of converting from type [java.lang.Integer] to type [java.util.Date]

Cause

This issue is caused by the weeklyScoreTrend.trendTime fields in the presidio-output-entity index, which are incorrectly set to 0 as Date fields instead of an empty string following the 12.5.1.0 upgrade.


Resolution

The only option to fix this issue is with a code change in 12.5.1.3. The 12.5.1.3 upgrade introduces a new DAG that resolves this issue.


Product Details

NetWitness Product Set: NetWitness Logs & Network
NetWitness Product/Service Type: UEBA
NetWitness Version/Condition: 12.5.1.0
Platform: AlmaLinux


Approval Reviewer Queue

Technical approval queue