NetOps Spectrum NCM configuration capture fails for Cisco S936 Secure Web Appliances with large files

Products

• Network Observability

Issue/Introduction

Cisco S936 configuration captures fail via NCM when file sizes are large and execution time exceeds one hour․​​​​‌​‍

ERROR MESSAGE: "SPC-NCM-20007 ... Endpoint read failed / -99" "SPC-OCC-10746"

Environment

 

• OS: Windows

• Product Release: 25.4.1

• Device: Cisco S936 Secure Web Appliance

• Network Configuration Manager (NCM)

 

Cause

The NCM thread-timeout-value in config.xml was set to 3,600 seconds (1 hour), causing the service to kill capture processes that took longer to complete due to the device's lack of paging support.

KNOWN LIMITATIONS: Settings such as jsch-read-datawait do not apply to custom Perl child processes, the thread-timeout-value is the primary limiter for these flows.

Resolution

1. INCREASE NCM THREAD TIMEOUT: The NCM service terminates threads that exceed the thread-timeout-value. You must increase this to accommodate the full duration of the capture.

   Path: [SPECROOT]/NCM/config.xml

   Action: Update lines 51-52 to a value exceeding your worst-case capture time.

   Original: 3600

   Recommended: 43200

   EXPECTED: The service will allow threads to run for up to 12 hours.

2. RESTART NCM SERVICE: The configuration file is only read during service startup.

   Action: Restart the NCM/SCM service using standard process control procedures.

   EXPECTED: The new timeout value is loaded into the active session.

3. OPTIMIZE CUSTOM PERL SCRIPT: Adjust your custom capture script to prevent premature exits and parsing errors.

   • REMOVE EXTRA OUTPUT: Ensure the script only prints the device configuration to STDOUT. Remove "print $ssh" or "print $chunk" statements as extra text confuses the NCM parser.

   • APPLY SSH TIMEOUTS: Wire the $capture_timeout variable into the SSH session ($ssh->timeout) before entering the long while loop.

   • FIX EXIT CONDITIONS: Do not exit the loop based on an "empty chunk." Use an explicit end condition, such as the appearance of a specific prompt or the tag.

   • RELAX ARGUMENT CAPS: Remove hardcoded limits (e.g., 600 seconds) within the script that prevent passing longer timeout values as arguments.

VERIFY SUCCESS:

• Run the NCM capture task for a Cisco S936 with a large configuration.

• Confirm the capture completes without the SPC-NCM-20007 error.

• Verify the captured configuration file is complete and not truncated.