Size roll for core appliances' database fails with error 'com.rsa.netwitness.carlos.transport.TanportException: Size roll operation aborted in RSA Netwitness 10.x

Issue

When trying to manually roll-out data using the below steps it fails.

Sessiondb on log decoder as an example:

1. Log into the SA GUI.
2. Click on Administration -> Services.
3. Select the log decoder service and Choose View -> Explore.
4. In the right-side pane, right-click on database and select Properties, select it will open a pane in the bottom
5. In the bottom-pane choose sizeRoll and 
6. In the parameters box, enter the following:  type=session maxSize="required size MB" <- (Ex: 30000 MB)

Sometimes the above commands fail with Error Message:
 

Cause

SA doesn't allow to manually roll-out more than half of the database size.

Resolution

Decrease the capacity of where the database is stored so it will automatically delete the old data.

1. Log into the SA GUI.
2. Click on Administration -> Services.
3. Select the log decoder service and Choose View -> Explore.
4. In the right-side pane, Open database tree and choose config. 
5. Jump to session.dir "take note of the current value" and change the value to the "needed value"
   It should automatically start deleting the old data. - check /var/log/messages.

Once the delete is completed, follow the same above steps and revert back the session.dir to the old value noted in point 5.

Product Details

RSA Product Set: Netwitness
RSA Product/Service Type: Core appliances
RSA Version/Condition: 10.X
Platform: CentOS

Summary

Size roll for core appliances' database fails with error 'com.rsa.netwitness.carlos.transport.TanportException: Size roll operation aborted.

Approval Reviewer Queue

RSA NetWitness Suite Approval Queue