cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1439
Views
0
Helpful
6
Replies

Cisco S170 Web Security Appliance - Critical message

pgiouvanellis
Level 1
Level 1

Hello everyone ,

 

We have a Cisco S170 Web Security Appliance installed and we start getting the follow critical message : 

 

An application fault occurred: ('aggregator/master_aggregator.py _process_export_files|604', "<class 'reporting.aggregator.master_aggregator.ExportProcessError'>", '', '[aggregator/master_aggregator.py main|268] [aggregator/master_aggregator.py watch_incoming_queue|392] [aggregator/master_aggregator.py _process_export_files|604]')

 

Is anyone has any idea what this message is about and what impact it has to our system ? 

 

Below are the info for our system 

 

Product: Cisco S170 Web Security Appliance

Model: S170

Version: 10.1.0-204

 

Thank You ,

Palaiologos 

6 Replies 6

balaji.bandi
Hall of Fame
Hall of Fame

Looks like you hit with some bug, raise an Cisco TAC case for this to look.

 

BB

***** Rate All Helpful Responses *****

How to Ask The Cisco Community for Help

Handy Putra
Cisco Employee
Cisco Employee

Hi,

 

The application fault that you received indicating there are issues in the reporting side of the appliance.

S170 has a very limited disks and disks i/o and reporting and WBRS update are normally the services that are disk i/o hungry and causing S170 to have all sort off issues such as reporting database failed and corrupted and latency.

 

Would recommend to delete the export files and journal files from the CLI to try to fix this. You can do this by using the hidden command from CLI:

diagnostic -> reporting -> DELETEEXPORTDB and DELETEJOURNAL

 

Please make sure before running the above, please disable the reporting process first:

diagnostic -> reporting -> DISABLE

 

If you are not comfortable in doing the above, would recommend to open a Cisco TAC case for the engineer to do it for you or if you already done the above and still getting the same application fault, would recommend to open TAC case for them to see from the backend for possible reporting database corruption.

 

Regards,

Handy Putra

what is the affect of execute the command 

 

diagnostic -> reporting -> DELETEEXPORTDB and DELETEJOURNAL

 

Am i going to lose reports or functionality of wsa...??

 

I nees to be sure of executing the command.

 

Did you ever done this before and have any affect?

 

Thank you 

Palaiologos

 

 

Hi,

 

Deleting the export files and journal files for reporting will not delete the reporting database since those files are environment files in the reporting database.

 

if you do deletedb then you will lose your reporting, however if your database has been confirmed corrupted, you might need to do that too 

 

Regards

Handy Putra

@Handy Putra

 

Question for you here, here is the most of the time WSA fails in terms of reporting. it corrupts, i have seen many times.

Work with TAC for 6months to fix, then we loose the data as mentioned.

 

even on S680 using M680 and 690.  - i heard it was fixed in 11.X  - looking at this case not. can you confirm.

 

 

BB

***** Rate All Helpful Responses *****

How to Ask The Cisco Community for Help

Hi Balaji,

 

Its all depends on what cause the database corruption, it could be hitting defect or excessive usage or too many WSAs connected to SMA for reporting that SMA could not handled, it could be when SMA pulled the reporting from WSA at that time the SMA having a glitch that can cause database corruption, etc

 

TAC engineer would be the best person to check on this from the backend.

Depending on how severe the database corruption is, some of them we can manually fix it without having to delete all the database, some of case we cant and need to delete the whole database.

 

However in regards to S170, reporting process and WBRS update are the processes that are resource hungry and consume most of the disk i/o. Due to this there are more chances that the reporting might be struggling and create all sort of issues in its database.

Again to get more information of what is going on in the appliance, opening TAC case would be ideal so engineer can check from the backend.

 

Regards

Handy Putra

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: