Update LDW_Core hangs on first run

Products

• Information Centric Analytics

Issue/Introduction

You are attempting to run the nightly RiskFabric Processing job for the first time after installing Information Centric Analytics (ICA) and step 11 (Update LDW_Core) won't complete.

You have installed version 6.6 or greater and you do not see the additional symptoms described in the article Update LDW_Core waiting on normality jobs.

Environment

Version : 6.x

Component : RiskFabric Processing

Resolution

The initial processing job run post-installation will run longer than subsequent runs. Depending upon the volume of entity and security events data in your environment, this can span multiple days in extreme cases.

For example, importing an unusually large number of network endpoints in conjunction with a large volume of data in motion (DIM) incidents imported from Symantec Data Loss Prevention (DLP) will require additional time to calculate sender and destination likelihood values. Once these are calculated, subsequent processing jobs will not need to recalculate these values for these endpoints and incidents.

Processing speed is a function of dedicated hardware resources and the volume of data to be processed. Refer to the article RiskFabric Processing performance factors and the Production and Development Sizing Recommendations for Symantec ICA section of the Symantec ICA Administrator Guide for more information.

To determine whether the nightly job is hung or simply taking longer than expected to complete, the following tools and procedures can be of assistance:

• SQL Server Profiler (profiler.exe)
• Identify currently running procedures
  1. Open SQL Server Management Studio (SSMS)
  2. Connect to the Database Engine hosting the RiskFabric relational database
  3. From the File menu, select New > Query with Current Connection
  4. Copy the following query and paste it in the new query editor window:
     

     USE RiskFabric;
     GO
     
     SELECT LogID,
            LogGroupID,
            LoginName,
            LogName,
            CAST(LogDescription AS nvarchar(255)) AS "LogDescription",
            StartDate,
            EndDate,
            RunMinutes,
            StatusFlag,
            SQLAgentJobName,
            StoredProcedureName,
            SourceTableName,
            DestinationTableName,
            DMLAction,
            RowsAffected,
            ErrorCode,
            ErrorDesc,
            ErrorSource,
            ErrorDate
     FROM   dbo.Log_DataTransformation WITH (NOLOCK)
     WHERE  StatusFlag = N'R' AND
            CAST(StartDate AS date) >= CAST(GETDATE()-7 AS date);

  5. Execute the statement by pressing the F5 key, clicking the Execute button in the SQL Editor toolbar, or selecting Execute from the Query menu

If you require assistance with running SQL Server Profiler or with interpreting the results of the Log_DataTransformation output, contact Broadcom support.