Runtime analytic (SIEM Integration) - Timeout

[flegare]

SIEM Integration analytic has been setup a while back (April 30-ish) in the customer's non-prod environment and we noticed it stopped responding back in late August.

Clients attempting to run the analytics through API get an error message back: "Control execution is taking longer than expected. You will be notified when the result is ready" along with a lovely http 500

Any idea as to what could possibly delay the execution?

Also, tenant was restarted last weekend for other test-related activities but I am wondering if restarting the tenant from back-end would have any positive outcome.

Thanks in advance!

[rushikeshvartak]

• Did you tried running report from postman ?

[flegare]

Yes, I did

[rushikeshvartak]

What are body parameters for api and also share analytics config screeenshot

[flegare]

Analytic was built following this: Saviynt SIEM Integration (saviyntcloud.com)

Postman screenshot:

[rushikeshvartak]

delete all old history of analytics and validate

[flegare]

We only kept one execution... deleted history and re-ran and got the same exception

[rushikeshvartak]

Try creating new analytics 

[flegare]

Tried that yesterday with the same result

[rushikeshvartak]

Is it happening with all analytics or this only 

[stalluri]

@flegare 
This is a defect, and an Elastic exception will be present in the logs. It will run and fail at the final stage. Check if the below error shows up in the log.

Error: org.hibernate.HibernateException: connnection proxy not usable after transaction completion

This is fixed in 24.9

[flegare]

I believe you are correct as far as the exception being present in the logs.  What is puzzling to me is this condition only occurs in the lower environment, while production does not see this.

Both environments at this client are running on 24.4

Is there any rational explanation as to why this would occur only in one of the environments?

[rushikeshvartak]

Does both version subversion same ?

[flegare]

How do you find the subversion?  Tried checking this link butit no longer works: rushi-dev.saviyntcloud.com

[rushikeshvartak]

https://forums.saviynt.com/t5/identity-governance/how-to-find-out-the-patch-number/m-p/104011#M68728...

https://rushi-sandbox.saviyntcloud.com/ECMv6/versionpage

[stalluri]

@flegare 

Something is happening with an elastic search in the final stage of creating data. Saviynt didn't specify any exact root cause. It was fixed in 24.9.

To check the sub-version, use:  https://domain.saviyntcloud.com/ECMv6/versionpage

[This post has been edited by a Moderator to remove sensitive information.]

[flegare]

There are indeed differences between the versions... which parameter should be focused on with regards to this issue?  logms?

[rushikeshvartak]

arsms

[flegare]

Dev shows Release-24.4.5
Prod shows Release-24.4.7

[rushikeshvartak]

Work with CSM to match both instance versions

[flegare]

I've been scanning the logs and cannot retrieve this specific exception for the latest errors though I recall seeing this in past executions - for which logs have since disappeared.  

Latest logs don't show exceptions... Will reach out to CSM for guidance anyways.

Thanks again!

[flegare · Accepted solution]

This one has been solved through an unexpected way: jobs were left on auto-pause.  Stop/Resume all jobs fixed the issue.