Sentinel Control Center (SCC) loads slowly, or fails to load, due to Active View historical data

  • 7011985
  • 19-Mar-2013
  • 11-Jun-2013

Environment

NetIQ Sentinel 7.0

Situation

When loading the Sentinel Control Center (SCC) the process may fail because of slowness when reading in Active View historical data, such as when using a slow connection or VPN.  In order for the Active Views to show up correctly when the SCC loads he data behind them, which may include millions of events, must all be present from the start.  If the data take too long to be sent to the SCC, because of a large number of active views, a slow connection to the SCC, or the server being busy with other tasks, the SCC may not load at all.  One possible error message that may result in this case is shown below as taken from the workstation's control_center0.0.log file:

Failed to initialize, shutting down


Resolution

Within the workstation home directory of the user loading the SCC is a directory named '.novell' with a subdirectory of 'sentinel' which contains configuration information, logs, and other data relevant to the Sentinel clients running on the workstation for that user.  Within this 'sentinel' directory is a 'config' directory holding the SentinelPreferences.properties file.  One option to improve the login performance of the SCC is to modify the following line within this file:

com.eSecurity.Sentinel.activeviews.historical.events=immediate

The line above tells the SCC to read in all historical data for all loading Active Views while the SCC is loading; changing the value to 'incremental' lets the SCC load these data after the login is complete, so while Active Views may be displayed after short delay the login itself succeeds and is often faster:

com.eSecurity.Sentinel.activeviews.historical.events=incremental

A third option is 'never' which instructs the SCC to never load historical data; in this case the Active View will show data from the time the SCC loads going forward but will not show data, if available, from before the SCC started.

This has been resolved in Sentinel 7.1