RSA Security Analytics - 'Failed to convert from type' error during investigations on concentrator

Issue

It has been reported that when running RSA Security Analytics 10.5.0.1 users were unable to do investigations on their concentrator and are seeing following error on the Investigation View on the SA UI. (Same error can be found in the following log file: /var/lib/netwitness/uax/logs/sa.log)
 


 

Cause

The cause of the issue is explained in JIRA SACE-3993 (Arithmetic Exception thrown for Meta Values Load in Navigate View).

RCA: NextGen sent the "group" as Non-Zero value while the "count" as ZERO. This caused SA Server to throw am Arithmetic Exception while calculating the Perecntage values for that Meta.

Changes: Changes has been made in SA Server to Display "Error - " as the Session Count when Non-Positive number is recieved as the Session Count.

Testing Effort: Not sure if we can reproduce this issue in House. Basically we need a Meta Value for which the count is "ZERO" returned by NextGen.

Resolution

This issue will be fixed in SA 10.5.1.  There will not be a work around for 10.5.0.1.

Product Details

RSA Product Set: Security Analytics
RSA Product/Service Type: SA Security Analytics UI
RSA Version/Condition: 10.5.0.1
Platform: CentOS
O/S Version: 6

Summary

Error: Failed to convert from type com.rsa.smc.sa.investigation.navigate.common.domain.model.MessageDataWrapper to type com.rsa.smc.sa.investigation.navigate.values.domain.model.MetaValueLoad

Approval Reviewer Queue

Technical approval queue