Warning message Range indexes are not in sync, please run repair in RSA Netwitness Archiver 10.6.1.0

Issue

Warning message below appears in /var/log/messages in Archiver.

Aug 17 02:24:35 saarchiver NwArchiver[128701]: [Broker] [warning] Range indexes are not in sync, please run 'repair'

Cause

Possible cause may be if Archiver had crashed or unexpectedly stopped or powered down, or perhaps if the collection files were being manually manipulated.
However it's recommended to collect the following information and open a JIRA for a RCA investigation.

- Turn on debug logs, an additional log will be generated indicated which global range values are out of sync. 
To turn on debug log level, 
Add debug in Archiver->Explore, /logs/config/log.levels, changes takes effect immediately.

- Collect /index ranges and /index gaps outputs BEFORE and AFTER running /archiver repair by following the steps below.

Index ranges output :
Archiver->Explore, right click on /index, select Properties, select "ranges" in drop-down list without Parameters and click Send.

Index gaps output :
Archiver->Explore, right click on /index,  select Properties, select "gaps" in drop-down list without Parameters and click Send .
​
- Collect nwtech dump with debug log enabled.

Resolution

- Run Repair on Archiver. To do this, 

SA UI -> Administration -> Services -> Archiver -> Explore, right click on /archiver, select Properties, select "repair" option in drop-down list in right pane and click on Send.

Internal Comments

Jemma Lee -- 22 Aug 2016
Created the article

James Moon -- 29 Aug 2016
Technically reviewed the article. Changed the formatting in Cause and Resolution.

Yasmine Dowidar -- 29 August 2016
Performed KCS review. Updated title to include product version and highlighted Note in yellow.

Product Details

RSA Product Set: Netwitness Logs and Packets
RSA Product/Service Type: Archiver
RSA Version/Condition: 10.6.1.0
Platform: CentOS
O/S Version: 6.7

Approval Reviewer Queue

ASOC Approval Group