Searches are much slower after 8.2.6 upgrade

Products

• Security Analytics

Issue/Introduction

The searches may become 3-5 times longer time due to a defect in release 8.2.6.  This was not a problem before the 8.2.6 upgrade.

Environment

Release : 8.2.6-55530 only

Cause

A defect was introduced into 8.2.6-55530 which corrupted the first line in one of our tables used to find index data.  This caused searches to unnecessarily search across much more of the data to find what was needed.

Resolution

The space_table_journal file must be corrected and an upgrade to 8.2.7 completed immediately afterward.  The problem can be seen by running walk_space_table_journal | head.  Include this with the case to provide what is needed to determine if it is the cause.

Support will need to provide a script to you and then log in to your system as root to fix the corruption.  An upgrade to at least 8.2.7 is required afterwards to prevent the corruption from happening again.