[Archive] Security Analytics Concentrator fails to start aggregation with error: TransportException: Message start was not recognized by /concentrator

Issue

The following error message are noticed when attempting to start aggregation on a Security Analytics Concentrator:

Aggregation failed to start.: Failed to process message start for /concentrator 
com.rsa.netwitness.carlos.transport.TransportException: Message start was not recognized by /concentrator

Resolution

This error message is a normal and common occurance.  It will always will appear when a concentrator appliance is rebooted, and if the concentrator service is restarted from the command line.

When watching that appliance in the Health and Wellness portion of the UI this message will appear when the service is coming up> Note that it can take some time for aggregation to complete its start sequences, such as “initializing databases” and “initializing the SDK”. Once databases and the sdk hooks are initialized properly, aggregation will then start.

Under these circumstances, these errors are "non" errors, and are part of the normal start up sequence.

Product Details

RSA Product Set: Security Analytics
RSA Product/Service Type: SA Security Analytics Server
RSA Version/Condition: 10.4.0.x / 10.5.0.0
Platform: CentOS
O/S Version: 6

Summary

This article provides information on aggregation on a Security Analytics Concentrator appliance (V10.4 or 10.5).

Approval Reviewer Queue

Technical approval queue