Reprocess jobs do not complete

Products

• Security Analytics

Issue/Introduction

The reprocessing of indexes for capture packets occurs each hour.  Any packets not indexed due to lack of resources will be indexed at a later time.  If a reprocessing, aka reindexing, job does not complete and seems to hang, it may be because the timestamp for the packets is 0, or the epoch in linux time.

The reprocessing status can be seen in Capture -> Summary.  Select Actions and Reprocessing.  The most recent 200 reprocessing jobs can be displayed.  Sort on % Complete to see the job currently being reindexed.

 

Environment

8.2.7 or earlier

Cause

This one time occurrence happened because a PCAP was imported with a timestamp of 0 and when imported, the timestamp was retained.

Resolution

This was corrected in the 8.2.8 release.

Additional Information

Always import PCAPs with a non zero timestamp or do not select the "Retain timestamp" option.