Schedule index slice saves to run at a specific time in RSA Security Analytics

Issue

A user wishes to initiate index save operation at a specific time rather than the default of every 8 hours.

Tasks

Use the steps outlined in this article to set one or more specific times to run the index save operations. 

1. Log into the Security Analytics UI and select the Concentrator service.
2. Open the Config tab for the Concentrator service.
3. Select the Files tab.
4. Select the scheduler file from the picklist.  Note that files are not presented in alphabetical order.
5. In the text editor, make the following changes:
    

   • Column 1: Existing Value
   • Column 2: New Value

   
   

   • Column 1: hours=8 pathname=/index msg=save
   • Column 2: # hours=8 pathname=/index msg=save

   
   

   • Column 1:
   • Column 2: time= pathname=/index msg=save

   
   

   • Column 1:
   • Column 2: time= pathname=/index msg=save

   
   

   • Column 1:
   • Column 2: time= pathname=/index msg=save

   
   
6. Click Apply.
7. Restart the Concentrator service.

Notes

You must enter a separate line for each specific time you wish to save an index slice.

For example, to run the index save operation at 1:00:00, 9:00:00 and 17:00:00 enter the following three lines in the scheduler:

If you only enter one time, it will be the functional equivalent of setting "hours=24" and will run once per day at that specified time. 

You may not use both an interval and specific time in the configuration file concurrently.  That is, you may not specific an "hours=x" and a "time=HH:MM:SS" in the scheduler simultaneously.

Generally you will be warned if you make a syntactical error.  However, some invalid entries may not be properly validated and may prevent you from successfully restarting the Concentrator service.  

Product Details

RSA Product Set: Security Analytics, NetWitness
RSA Product/Service Type: Concentrator
RSA Version/Condition: 9.8.x, 10.3.x, 10.4.x, 10.5.x
Platform: CentOS
O/S Version: EL5, EL6

Summary

Use this article to schedule index slice saves to run a one or more speficic times rather than running at the default interval which is every 8 hours.

Approval Reviewer Queue

ASOC Approval Group