We have two cisco ESA virtual appliance C100V running in cluster on 12.5.1.-031. Centralized message tracking not enabled.
Then I trying to do message tracking for "Search rejected connections only", it's crashing with "An application error has occurred and has been logged to the GUI log.". After that, message tracking page starts crashing every time, till I clear cookies in browser.
GUI log have some kind of messages:
Fri Nov 29 10:27:06 2019 Critical: An application fault occurred: ('monitor/message_tracking.py processConnectionResultsList|2144', "<type 'exceptions.IndexError'>", 'list index out of range', '[util/Aquarium.py screenLoop|408] [util/InternalLibrary.py inverseExtend|328] [util/InternalLibrary.py __call__|769] [screen/Controller.py __call__|30] [util/InternalLibrary.py __call__|769] [screen/CommonController.py __call__|49] [util/InternalLibrary.py __call__|769] [screen/AppController.py __call__|197] [util/InternalLibrary.py __call__|771] [monitor/message_tracking.py __call__|305] [screen/Controller.py executeAction|73] [monitor/message_tracking.py doSearchAction|1210] [monitor/message_tracking.py _processResults|2352] [monitor/message_tracking.py processConnectionResults|2116] [monitor/message_tracking.py processConnectionResultsList|2144]')
How we can fix this? We are perform two updates on this week - from 11.1.0-072 to 11.1.1-042, and from 11.1.1-042 to 12.5.1-031. We dont try such kind of tracking before update, so I'm not sure that this problem in latest update.
As it's on 12.5.1 and the app fault is exactly what we are seeing. A by-product of this bug is that once you search it once; your access to tracking will be locked out until you log out and log back in.
It is resolved in an upcoming 12.5.1 and version 13 build (which we're still pending on release). In the interim, it's less than ideal but please refer to the workaround note.