Reprocessing job not moving forward

Products

• Security Analytics
• Security Analytics - VA

Issue/Introduction

The reprocessing job is stuck because it appears a PCAP was imported with a packet with timestamp 0 and retained timestamps was selected.

Resolution

The script stj_clear_zero_timestamp_entries.sh will assist in nullifying the space table journal entries with a start timestamp of 0.

This is used by doing the following:

1. Place the script in /home on the appliance
2. cd /home/
3. scotus stop
4. mount /pfs
5. mount /var/lib/solera/meta
6. bash ./stj_clear_zero_timestamp_entries.sh > stj.out.txt
7. cat stj.out.txt | generate_space_table_journal_from_text -j space_table_journal_v4

This results in a new space table journal in /home. Validate it by doing the following:

1. walk_space_table_journal > old.txt
2. walk_space_table_journal -j space_table_journal_v4 > new.txt
3. diff old.txt new.txt to confirm the only altered entries are those which previously had a 0 start timestamp.

If the validation succeeds,

1. cp /var/lib/solera/meta/space_table_journal_v4 /home/space_table_journal_v4.backup
2. cp /home/space_table_journal_v4 /var/lib/solera/meta/space_table_journal_v4
3. walk_space_table_journal > final.txt
4. diff new.txt final.txt
   
   should have no differences except:
   
   [root@]# diff new.txt final.txt

< Space table journal name: space_table_journal_v4
—
> Space table journal name: /var/lib/solera/meta/space_table_journal_v4
5. scotus start