09-28-2018 06:35 AM - edited 09-28-2018 06:36 AM
Hello everyone ,
We have a Cisco S170 Web Security Appliance installed and we start getting the follow critical message :
An application fault occurred: ('aggregator/master_aggregator.py _process_export_files|604', "<class 'reporting.aggregator.master_aggregator.ExportProcessError'>", '', '[aggregator/master_aggregator.py main|268] [aggregator/master_aggregator.py watch_incoming_queue|392] [aggregator/master_aggregator.py _process_export_files|604]')
Is anyone has any idea what this message is about and what impact it has to our system ?
Below are the info for our system
Product: Cisco S170 Web Security Appliance
Model: S170
Version: 10.1.0-204
Thank You ,
Palaiologos
09-28-2018 12:20 PM
Looks like you hit with some bug, raise an Cisco TAC case for this to look.
09-28-2018 05:32 PM
Hi,
The application fault that you received indicating there are issues in the reporting side of the appliance.
S170 has a very limited disks and disks i/o and reporting and WBRS update are normally the services that are disk i/o hungry and causing S170 to have all sort off issues such as reporting database failed and corrupted and latency.
Would recommend to delete the export files and journal files from the CLI to try to fix this. You can do this by using the hidden command from CLI:
diagnostic -> reporting -> DELETEEXPORTDB and DELETEJOURNAL
Please make sure before running the above, please disable the reporting process first:
diagnostic -> reporting -> DISABLE
If you are not comfortable in doing the above, would recommend to open a Cisco TAC case for the engineer to do it for you or if you already done the above and still getting the same application fault, would recommend to open TAC case for them to see from the backend for possible reporting database corruption.
Regards,
Handy Putra
09-29-2018 06:45 AM - edited 09-29-2018 06:49 AM
what is the affect of execute the command
diagnostic -> reporting -> DELETEEXPORTDB and DELETEJOURNAL
Am i going to lose reports or functionality of wsa...??
I nees to be sure of executing the command.
Did you ever done this before and have any affect?
Thank you
Palaiologos
09-29-2018 05:11 PM
Hi,
Deleting the export files and journal files for reporting will not delete the reporting database since those files are environment files in the reporting database.
if you do deletedb then you will lose your reporting, however if your database has been confirmed corrupted, you might need to do that too
Regards
Handy Putra
09-30-2018 01:11 AM
Question for you here, here is the most of the time WSA fails in terms of reporting. it corrupts, i have seen many times.
Work with TAC for 6months to fix, then we loose the data as mentioned.
even on S680 using M680 and 690. - i heard it was fixed in 11.X - looking at this case not. can you confirm.
09-30-2018 05:15 PM
Hi Balaji,
Its all depends on what cause the database corruption, it could be hitting defect or excessive usage or too many WSAs connected to SMA for reporting that SMA could not handled, it could be when SMA pulled the reporting from WSA at that time the SMA having a glitch that can cause database corruption, etc
TAC engineer would be the best person to check on this from the backend.
Depending on how severe the database corruption is, some of them we can manually fix it without having to delete all the database, some of case we cant and need to delete the whole database.
However in regards to S170, reporting process and WBRS update are the processes that are resource hungry and consume most of the disk i/o. Due to this there are more chances that the reporting might be struggling and create all sort of issues in its database.
Again to get more information of what is going on in the appliance, opening TAC case would be ideal so engineer can check from the backend.
Regards
Handy Putra
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide