RealeyesIDS Spooler Support Library Messages



Network Transport messages


init_ssl: Invalid SLL initialize type
Description (ERR):
The SSL initialization is for a client or a server.
Response:
Report the problem to application developers.

init_ssl: Error initializing SSL: error reason
Description (ERR):
The creation of the SSL environment structures failed.
Response:
Troubleshoot operating system or network problem.

init_ssl: Error processing certificate file filename: error reason
Description (ERR):
There was an error processing the certificate file.
Response:
Correct the certificate file based on the error reason.

init_ssl: Error processing private key file 'filename: error reason
Description (ERR):
There was an error processing the private key.
Response:
Correct the private key file based on the error reason.

init_ssl: Error validating private key file filename: error reason
Description (ERR):
The private key does not match the certificate public key.
Response:
Correct the private key file based on the error reason.

init_ssl: SSL environment initialized
Description (NOTE):
Initialization of the SSL environment was successful.
Response:
None.

rae_listen: Unable to get network address information: error reason
Description (ERR):
Attempt to get network address information failed.
Response:
Troubleshoot operating system or network problem.

rae_listen: Unable to open socket: error reason
Description (ERR):
Attempt to open socket failed for displayed reason.
Response:
Troubleshoot operating system or network problem.

rae_listen: Unable to set socket 'socket' to reuse address
Description (ERR):
Attempt to set socket to reuse the address to bypass waiting for the close timeout failed.
Response:
Troubleshoot operating system or network problem.

rae_listen: Unable to set socket 'socket' to IPV6 Only
Description (ERR):
Attempt to set socket to accept IP V6 packets only failed.
Response:
Troubleshoot operating system or network problem.

rae_listen: Unable to bind socket 'socket': error reason
Description (ERR):
Attempt to open socket failed for displayed reason.
Response:
Troubleshoot operating system or network problem.

rae_listen: Unable to listen on socket 'socket': error reason
Description (ERR):
Attempt to open socket failed for displayed reason.
Response:
Troubleshoot operating system or network problem.

rae_listen: Unable to listen on socket 'socket': error reason
Description (WARN):
Attempt to open socket failed for displayed reason.
Response:
Troubleshoot operating system or network problem.

rae_listen: Ready for requests on port 'port', socket 'socket'
Description (NOTE):
Attempt to open socket was successful.
Response:
None

rae_listen: No sockets available for listener
Description (ERR):
No sockets were opened, see previous messages for details
Response:
Troubleshoot operating system or network problem.

rae_listen: Listener on port 'port' socket 'socket' disconnected
Description (NOTE):
Attempt to close socket was successful.
Response:
None

rae_listen: Error stopping listener on socket 'socket'
Description (ALERT):
Stopping listener failed.
Response:
Verify problem is not an intrusion, and correct

rae_listener: Error accepting connection: error reason
Description (ERR):
Attempt to accept connection failed for displayed reason
Response:
Troubleshoot operating system or network problem.

rae_listener: Error getting connected host information: error reason
Description (WARN):
Attempt to accept connection failed for displayed reason
Response:
Troubleshoot operating system or network problem.

rae_listener: Failed to allocate host name buffer: error reason
Description (ERR):
The network manager uses system memory. If the host name buffer cannot be allocated, then the application will have to be restarted.
Response:
Troubleshoot the problem based on the error reason.

rae_listener: Failed to allocate port buffer: error reason
Description (ERR):
The network manager uses system memory. If the port buffer cannot be allocated, then the application will have to be restarted.
Response:
Troubleshoot the problem based on the error reason.

rae_listener: Error formatting connected host information: error reason
Description (ERR):
Attempt to accept connection failed for displayed reason
Response:
Troubleshoot operating system or network problem.

rae_listener: Session reset for new session with host
Description (WARN):
There was an existing session with the host requesting a new session. However, checking the status indicated that the existing session had failed. It is assumed that this is a valid attempt to re-establish the session.
Response:
Verify problem is not an intrusion, and correct if it is.

rae_listener: Session already established with host
Description (WARN):
A session already exists with the host requesting a new session.
Response:
Verify problem is not an intrusion, and correct if it is.

rae_listener: Connection not accepted from host port 'port' on socket 'socket'
Description (ALERT):
Attempt to accept connection failed for displayed reason
Response:
Troubleshoot operating system or network problem.

rae_listener: SSL connection not created for host: error reason
Description (ERR):
A new SSL connection could not be created.
Response:
Troubleshoot operating system or network problem based on the error reason.

rae_listener: Failed to allocate new BIO socket
Description (ERR):
The allocation of an SSL I/O abstraction environment failed.
Response:
Troubleshoot operating system or network problem.

rae_listener: SSL Connection not accepted from host: error reason
Description (ERR):
The attempt to establish an SSL connection failed.
Response:
Troubleshoot operating system or network problem based on the error reason.

rae_listener: SSL connection accepted
Description (INFO):
The SSL connection was successfully established.
Response:
None.

rae_listener: No SSL client certificate
Description (INFO):
The client on an SSL connection did not provide a certificate.
Response:
The SSL certificate exchange validates the connection. Without it, there is a possibility that a man-in-the-middle attack could occur. Verify that the client is configured correctly.

rae_listener: Invalid certificate subject from host
Description (ERR):
The client certificate on an SSL connection was invalid.
Response:
Validate client SSL certificate.

rae_listener: Invalid certificate issuer from host
Description (ERR):
The client certificate on an SSL connection was invalid.
Response:
Validate client SSL certificate.

rae_listener: Connect accepted from host, port 'port' on socket 'socket'
Description (NOTE):
The connection has been accepted and is ready for data transfer.
Response:
None.

rae_listener: Session not set to nonblocking: error reason
Description (NOTE):
The session will wait for data reads and writes to complete before returning control to the application. This will affect performance.
Response:
Troubleshoot operating system based on the error reason.

rae_listener: Session not set for fast close: error reason
Description (ERR):
The attempt to set the socket to close immediately failed. The connection will continue, but if the are network problems, there may be problems with the application.
Response:
Troubleshoot operating system or network problem.

rae_listener: KEEPALIVE not activated: error reason
Description (WARN):
The attempt to activate the KEEPALIVE option failed. The connection will continue, but if the are network problems, they will go undetected.
Response:
Troubleshoot operating system problem based on the error reason.

rae_listener: KEEPALIVE idle time not set: error reason
Description (WARN):
The attempt to set the KEEPALIVE time to 5 min. failed. The connection will continue, but if the are network problems, they may go undetected for up to 2 hours.
Response:
Operating system does not support the TCP_KEEPIDLE socket option. If the system KEEPALIVE idle time can be changed in configuration files, set it to 5 min.

rae_session: Unable to get network address information: error reason
Description (ERR):
Attempt to get network address information failed for displayed reason.
Response:
Troubleshoot operating system or network problem.

rae_session: Unable to get socket: error reason
Description (ERR):
Attempt to get network session socket failed.
Response:
Troubleshoot operating system or network problems

rae_session: Unable to connect to host 'host'
Description (ERR):
Attempt to connect to specified host failed.
Response:
Troubleshoot operating system or network problems

rae_session: Connection to host 'host' not established
Description (WARN):
Network connection attempt failed, see previous messages for details
Response:
Troubleshoot operating system or network problem.

rae_session: Error creating SSL environment: error reason
Description (ERR):
The allocation of the SSL structure failed.
Response:
Troubleshoot operating system or network problems based on the error reason.

rae_session: SSL connect error: error reason
Description (ERR):
Attempt to establish an SSL connection failed.
Response:
Troubleshoot operating system or network problems based on the error reason.

rae_session: Failed to get SSL certificate: error reason
Description (WARN):
The attempt to receive an SSL certificate failed.
Response:
Troubleshoot operating system or network problems based on the error reason.

rae_session: Invalid SSL certificate subject: error reason
Description (ERR):
The attempt to receive an SSL certificate failed.
Response:
Troubleshoot operating system or network problems based on the error reason.

rae_session: Invalid SSL certificate issuer: error reason
Description (ERR):
The attempt to receive an SSL certificate failed.
Response:
Troubleshoot operating system or network problems based on the error reason.

rae_session: Session ready on socket 'socket', port 'port'
Description (NOTE):
Network session is connected and ready for data.
Response:
None

rae_session: Request to close NULL SSL session
Description (WARN):
Network session does not exist.
Response:
None

rae_session: Error closing SSL session: error reason
Description (ERR):
Closing SSL network session failed.
Response:
Troubleshoot system or network problem based on the error reason.

rae_session: Session on socket 'socket' disconnected
Description (NOTE):
Network session has been disconnected.
Response:
None

rae_session: Session on socket 'socket' not disconnected
Description (WARN):
Network session has been disconnected.
Response:
Verify problem is not an intrusion, and correct

rae_net_transmit: Error checking in select: error reason
Description (WARN):
An error occurred while waiting for a network slowdown to clear.
Response:
Troubleshoot system problem based on the error reason.

rae_net_transmit: SSL Session ended
Description (WARN):
The network session ended, which is not expected behavior from the perspective of the transmitter.
Response:
Troubleshoot network or remote host error.

rae_net_transmit: SSL syscall error:error reason
Description (ERR):
The network session ended, which is not expected behavior from the perspective of the transmitter.
Response:
Troubleshoot network or remote host error.

rae_net_transmit: SSL EOF detected
Description (WARN):
The network session ended, which is not expected behavior from the perspective of the transmitter.
Response:
Troubleshoot network or remote host error.

rae_net_transmit: SSL error:error reason
Description (WARN):
An SSL error occurred.
Response:
Troubleshoot network or remote host error based on the error reason.

rae_net_transmit: Session ended
Description (WARN):
The network session ended, which is not expected behavior from the perspective of the transmitter.
Response:
Troubleshoot network or remote host error.

rae_net_transmit: Error writing data: error reason
Description (ERR):
A network error was detected while trying to send data.
Response:
Troubleshoot system errors.

rae_net_receive: Failed to allocate receive structure: error reason
Description (ERR):
The network manager uses system memory. If the receive structure cannot be allocated, then the application will have to be restarted.
Response:
Troubleshoot the problem based on the error reason.

rae_net_receive: Error checking in select: error reason
Description (WARN):
An error occurred while waiting for a network slowdown to clear.
Response:
Troubleshoot system problem based on the error reason.

rae_net_receive: SSL Session ended
Description (WARN):
The network session ended, which is not expected behavior from the perspective of the transmitter.
Response:
Troubleshoot network or remote host error.

rae_net_receive: SSL syscall error:error reason
Description (WARN):
The network session ended, which is not expected behavior from the perspective of the transmitter.
Response:
Troubleshoot network or remote host error.

rae_net_receive: EOF received that violates protocol
Description (WARN):
The network session ended, which is not expected behavior from the perspective of the transmitter.
Response:
Troubleshoot network or remote host error.

rae_net_receive: SSL error:error reason
Description (WARN):
An SSL error occurred.
Response:
Troubleshoot network or remote host error based on the error reason.

rae_net_receive: Error reading data: error reason
Description (ERR):
A network error was detected while trying to receive data.
Response:
Troubleshoot system error based on system code.

rae_net_receive: Session ended while receiving data
Description (ERR):
A network error was detected while trying to receive data.
Response:
Troubleshoot system error based on system code.

rae_net_receive: Error checking for data: error reason
Description (WARN):
A network error was detected while checking for more data to receive.
Response:
Troubleshoot system problem based on the error reason.

rae_net_status: Failed to get error value for Socket: error reason
Description (ERR):
If a connection is lost outside of a transfer, then the status should be available through the getsockopt call. However, the attempt to get the status failed. It is assumed that the session has failed, and it is handled that way.
Response:
Troubleshoot system problem based on the error reason.

rae_net_status: Connection error: error reason
Description (WARN):
If a data connection is lost outside of a transfer, then the status should be available through the getsockopt call. All errors result in the session being shut down but the Spooler continues processing.
Response:
Troubleshoot network problem based on the error reason.

rae_net_ready: Error checking for data: error reason
Description (WARN):
A network error was detected while checking for more data to receive.
Response:
Troubleshoot system problem based on the error reason.



Spooler messages


spooler_init: Error setting signal: signal
Description (ERR):
The attempted to set an interrupt handler for the signal, but could not.
Response:
Troubleshoot operating system problem.

spooler_init: Error reading Manager to Spooler pipe: error reason
Description (ERR):
Reading a message from the Manager to Spooler pipe failed.
Response:
Troubleshoot operating system problem.

spooler_init: Failed to get circular buffer shared memory segment: error reason
Description (CRIT):
The highest location available to the Spooler is found by allocating a small buffer. If the system is unable to return a shared memory buffer, the application will have to be restarted.
Response:
This buffer uses swappable storage that is allocated by the system. The shared memory system calls are dependent on the system configuration. On a Linux system, use the sysctl command to configure the system settings. Also, if the allocation fails, there may not be enough swap space available. If this occurs repeatedly, then increase the swap partition. Otherwise, recommend to management that the hardware be upgraded.

spooler_init: Failed to attach circular buffer: error reason
Description (CRIT):
If the system is unable to attach a circular buffer, the application will have to be restarted.
Response:
This buffer uses swappable storage that is allocated by the system. If the allocation fails, there may not be enough swap space available. If this occurs repeatedly, then increase the swap partition. Otherwise, recommend to management that the hardware be upgraded.

spooler_init: Failed to set circular buffer shared memory segment to automatically release: error reason
Description (WARN):
The Spooler is unable to set a circular buffer shared memory segment to automatically release. Although the application continues to run, this could lead to memory being unavailable even after the application is restarted.
Response:
Troubleshoot the system problem based on the error reason. The shared memory system calls are dependent on the system configuration. On a Linux system, use the sysctl command to configure the system settings.

spooler_init: Failed to detach circular buffer: error reason
Description (WARN):
The highest location available to the Spooler is found by allocating a small buffer. If the Spooler is unable to detach this buffer, there may be a system problem, but the application continues.
Response:
This buffer uses swappable storage that is allocated by the system. If the allocation fails, there may not be enough swap space available. If this occurs repeatedly, then increase the swap partition. Otherwise, recommend to management that the hardware be upgraded.

spooler_init: Error sending Spooler SYN response: error reason
Description (ERR):
Writing a message to the Spooler to Manager pipe failed. This means that the pipe was initialized incorrectly when the Manager started the Spooler.
Response:
Troubleshoot operating system problem.

spooler_init: Error sending Spooler Flag response: error reason
Description (ERR):
Writing a message to the Spooler to Manager pipe failed. This means that the pipe was initialized incorrectly when the Manager started the Spooler.
Response:
Troubleshoot operating system problem.

spooler_init: Failed to allocate Spooler user name error reason
Description (CRIT):
The Spooler user name buffer allocation failed.
Response:
Troubleshoot system problem based on the error reason.

spooler_init: Error sending Spooler user name response: error reason
Description (ERR):
Writing a message to the Spooler to Manager pipe failed. This means that the pipe was initialized incorrectly when the Manager started the Spooler.
Response:
Troubleshoot operating system problem.

spooler_init: Failed to allocate Spooler home directory error reason
Description (CRIT):
The Spooler home directory buffer allocation failed.
Response:
Troubleshoot system problem based on the error reason.

spooler_init: Error sending Spooler home directory response: error reason
Description (ERR):
Writing a message to the Spooler to Manager pipe failed. This means that the pipe was initialized incorrectly when the Manager started the Spooler.
Response:
Troubleshoot operating system problem.

spooler_init: Failed to allocate Event Analyzer to Spooler FIFO name error reason
Description (ERR):
The Spooler host name buffer allocation failed.
Response:
Troubleshoot system problem based on the error reason.

spooler_init: Error sending Event Analyzer to Spooler FIFO response: error reason
Description (ERR):
Writing a message to the Spooler to Manager pipe failed. This means that the pipe was initialized incorrectly when the Manager started the Spooler.
Response:
Troubleshoot operating system problem based on the error reason.

spooler_init: Failed to allocate Spooler to Event Analyzer FIFO name error reason
Description (ERR):
The Spooler host name buffer allocation failed.
Response:
Troubleshoot system problem based on the error reason.

spooler_init: Error sending Spooler to Event Analyzer FIFO response: error reason
Description (ERR):
Writing a message to the Spooler to Manager pipe failed. This means that the pipe was initialized incorrectly when the Manager started the Spooler.
Response:
Troubleshoot operating system problem based on the error reason.

spooler_init: Error sending Spooler FLIM response: error reason
Description (ERR):
Writing a message to the Spooler to Manager pipe failed. This means that the pipe was initialized incorrectly when the Manager started the Spooler.
Response:
Troubleshoot operating system problem based on the error reason.

spooler_init: Error sending Spooler CPORT response: error reason
Description (ERR):
Writing a message to the Spooler to Manager pipe failed. This means that the pipe was initialized incorrectly when the Manager started the Spooler.
Response:
Troubleshoot operating system problem based on the error reason.

spooler_init: Error sending Spooler DPORT response: error reason
Description (ERR):
Writing a message to the Spooler to Manager pipe failed. This means that the pipe was initialized incorrectly when the Manager started the Spooler.
Response:
Troubleshoot operating system problem based on the error reason.

spooler_init: Failed to allocate Spooler hosterror reason
Description (CRIT):
The Spooler does not use the Realeyes Analysis Engine memory management. Therefore Spooler structures are allocated using the system allocation function. If there is an error, then there is a problem in the system memory management.
Response:
Troubleshoot system problem. If there is not enough memory available after the analysis engine shared memory block is allocated, then adjust the command line parameters.

spooler_init: Failed to allocate Spooler host nameerror reason
Description (CRIT):
The Spooler host name buffer allocation failed.
Response:
Troubleshoot system problem based on the error reason.

spooler_init: Error sending Spool file name response: error reason
Description (ERR):
Writing a message to the Spooler to Manager pipe failed. This means that the pipe was initialized incorrectly when the Manager started the Spooler.
Response:
Troubleshoot operating system problem based on the error reason.

spooler_init: Failed to allocate Spooler host nameerror reason
Description (CRIT):
The Spooler host name buffer allocation failed.
Response:
Troubleshoot system problem based on the error reason.

spooler_init: No Spooler hosts defined
Description (ERR):
There are no hosts defined for spooling Analysis Data.
Response:
Correct the manager configuration file..

spooler_init: Failed to allocate Spooler inet list
Description (ERR):
The Spooler does not use the Realeyes Analysis Engine memory management. Therefore the Spooler inet list is allocated using the system allocation function. If there is an error, then there is a problem in the system memory management.
Response:
Troubleshoot system problem. If there is not enough memory available after the analysis engine shared memory block is allocated, then adjust the command line parameters.

spooler_init: Failed to allocate Spooler control network list
Description (ERR):
The Spooler does not use the Realeyes Analysis Engine memory management. Therefore the Spooler control network list is allocated using the system allocation function. If there is an error, then there is a problem in the system memory management.
Response:
Troubleshoot system problem. If there is not enough memory available after the analysis engine shared memory block is allocated, then adjust the command line parameters.

spooler_init: Error sending Local host name response: error reason
Description (ERR):
Writing a message to the Spooler to Manager pipe failed. This means that the pipe was initialized incorrectly when the Manager started the Spooler.
Response:
Troubleshoot operating system problem based on the error reason.

spooler_init: Unexpected data to Spooler: data
Description (ERR):
The Manager to Spooler pipe received unexpected data, which is returned to the Manager as a message.
Response:
Troubleshoot spooler.

spooler_init: Invalid user name user name: error reason
Description (ERR):
An invalid user name was supplied for the application. This ID is used to lower the access privileges of the Spooler which is the only process with direct access to the network, and this problem may result in a security breach.
Response:
Verify manager configuration file.

spooler_init: Failed to create spool file directory: error reason
Description (ERR):
The spool file directory could not be created.
Response:
Troubleshoot system problem based on error reason.

spooler_init: Failed to chdir to Spooler home: error reason
Description (ERR):
The Spooler was unable to change to the spool directory to getting the list of spooled files during initialization.
Response:
Troubleshoot system problem based on error reason.

spooler_init: Event Analyzer to Spooler FIFO inaccessible: error reason
Description (ERR):
The FIFO for the Event Analyzer to notify the Spooler of Analysis Records cannot be opened. Since this is the primary purpose of the Spooler, it shuts down.
Response:
Troubleshoot system problem based on the error reason.

spooler_init: Failed to open spool file directory: error reason
Description (ERR):
The spool file directory could not be created.
Response:
Troubleshoot system problem based on error reason.

spooler_init: Failed to allocate spool file structure: error reason
Description (ERR):
The Spooler does not use the Realeyes Analysis Engine memory management. Therefore the spool file structure is allocated using the system allocation function. If there is an error, then there is a problem in the system memory management.
Response:
Troubleshoot system problem. If there is not enough memory available after the analysis engine shared memory block is allocated, then adjust the command line parameters.

spooler_init: Failed to allocate spool file list: error reason
Description (ERR):
The Spooler does not use the Realeyes Analysis Engine memory management. Therefore the spool file list is allocated using the system allocation function. If there is an error, then there is a problem in the system memory management.
Response:
Troubleshoot system problem. If there is not enough memory available after the analysis engine shared memory block is allocated, then adjust the command line parameters.

rae_process_event: Failed to open Spooler to Event Analyzer FIFO: error reason
Description (ERR):
Opening the FIFO for the Spooler to acknowledge Analysis Records failed. Since this is the primary purpose of the Spooler, it shuts down.
Response:
Troubleshoot system problem based on the error reason.

rae_process_event: Error reading Event Analyzer to Spooler message type
Description (ERR):
Reading the 4 character message type sent from the Event Analyzer to the Spooler through the FIFO failed.
Response:
Troubleshoot operating system problem.

rae_process_event: Error reading Event Analyzer to Spooler message data
Description (ERR):
Reading the message data sent from the Event Analyzer to the Spooler through the FIFO defining the shared memory buffer failed.
Response:
Troubleshoot operating system problem.

rae_process_event: Failed to open Event Analyzer to Spooler FIFO: error reason
Description (ERR):
Opening the FIFO for the Spooler to receive the Analysis Record information failed. Since this is the primary purpose of the Spooler, it shuts down.
Response:
Troubleshoot system problem based on the error reason.

rae_process_event: Invalid Event Analyzer message size size
Description (ERR):
Reading a message from the Manager to Spooler pipe failed.
Response:
Troubleshoot operating system problem.

rae_process_event: Error attaching Event Analyzer circular buffer (shared memory ID, buffer address): error reason
Description (ERR):
Attaching a shared memory segment created by the Event Analyzer in read only mode failed.
Response:
Troubleshoot operating system problem.

rae_process_event: Failed to allocate circular buffer block: error reason
Description (ERR):
The Spooler does not use the Realeyes Analysis Engine memory management. Therefore the circular buffer block structure is allocated using the system allocation function. If there is an error, then there is a problem in the system memory management.
Response:
Troubleshoot system problem.

rae_process_event: Event Analyzer buffer too big
Description (ERR):
The shared memory segment created by the Event Analyzer is bigger than the maximum allowed size of 1 Gigabyte.
Response:
Report problem to application development staff.

rae_process_event: Error attaching Event Analyzer buffer: error reason
Description (ERR):
Attaching a shared memory segment created by the Event Analyzer in read only mode failed.
Response:
Troubleshoot operating system problem.

rae_process_event: Event Analyzer buffer too big
Description (ERR):
The shared memory segment created by the Event Analyzer is bigger than the maximum allowed size of 1 Gigabyte.
Response:
Report problem to application development staff.

rae_process_event: Invalid Event Analyzer message: message
Description (ERR):
The message sent by the Event Analyzer is not parsable. The Event Analyzer to Spooler FIFO is closed to flush remaining data from it.
Response:
Report problem to application development staff.

rae_process_event: Error sending Spooler to Event Analyzer FIFO response: error reason
Description (WARN):
Writing an acknowledgement message to the Event Analyzer failed. This means that there are FIFO errors.
Response:
Troubleshoot operating system problem based on the error reason.

rae_process_event: Error sending Spooler to Event Analyzer FIFO error response: error reason
Description (ERR):
Writing a negative acknowledgement message to the Event Analyzer failed. This means that there are FIFO errors.
Response:
Troubleshoot operating system problem based on the error reason.

rae_process_event: Failed to allocate net data structure: error reason
Description (ERR):
The Spooler does not use the Realeyes Analysis Engine memory management. Therefore the net data structure is allocated using the system allocation function. If there is an error, then there is a problem in the system memory management.
Response:
Troubleshoot system problem. If there is not enough memory available after the analysis engine shared memory block is allocated, then adjust the command line parameters.

rae_process_mgr: Error reading Manager pipe: error reason
Description (ERR):
There was an error reading the pipe, or the Manager has shutdown. Either way, the Spooler will not function properly and must shutdown.
Response:
Troubleshoot problem based on error reason.

rae_process_mgr: Failed to open manager file filename: error reason
Description (ERR):
The Spooler could not open the file containing data from the manager to be sent to the external management host.
Response:
Troubleshoot the problem based on the error reason.

rae_process_mgr: Failed to allocate net data structure: error reason
Description (ERR):
The Spooler does not use the Realeyes Analysis Engine memory management. Therefore the net data structure is allocated using the system allocation function. If there is an error, then there is a problem in the system memory management.
Response:
Troubleshoot system problem. If there is not enough memory available after the analysis engine shared memory block is allocated, then adjust the command line parameters.

rae_process_mgr: Error reading Manager file: error reason
Description (ERR):
There was an error reading the Manager file. The data is discarded to avoid problems at the external management host.
Response:
Troubleshoot problem based on error reason.

rae_process_mgr: Premature EOF for Manager file: error reason
Description (ERR):
End of file was reached while reading the Manager file before it was expected. The data is discarded to avoid problems at the external management host.
Response:
Troubleshoot problem based on error reason.

rae_spool_disk: Failed to allocate file structure: error reason
Description (ERR):
The Spooler does not use the Realeyes Analysis Engine memory management. Therefore the file structure is allocated using the system allocation function. If there is an error, then there is a problem in the system memory management.
Response:
Troubleshoot system problem. If there is not enough memory available after the analysis engine shared memory block is allocated, then adjust the command line parameters.

rae_spool_disk: Failed to unmap spool file: error reason
Description (ERR):
The spool file with previously mapped to memory was not unmapped when complete.
Response:
Troubleshoot system problem based on error reason.

rae_spool_disk: Failed to open spool file: error reason
Description (ERR):
The spool file to save data until a network connection is available was not opened.
Response:
Troubleshoot system problem based on error reason.

rae_spool_disk: Failed to write to spool file: error reason
Description (ERR):
The spool file to save data until a network connection is available had an error when writing to it.
Response:
Troubleshoot system problem based on error reason.

rae_send_spool: Failed to open spool file: error reason
Description (ERR):
The spool file with data to transfer was not opened.
Response:
Troubleshoot system problem based on error reason.

rae_send_spool: Failed to mmap spool file: error reason
Description (ERR):
The spool file with data to transfer was not mapped to memory.
Response:
Troubleshoot system problem based on error reason.

rae_send_spool: Failed to allocate Network data structure: error reason
Description (ERR):
The Spooler does not use the Realeyes Analysis Engine memory management. Therefore the Network data structure is allocated using the system allocation function. If there is an error, then there is a problem in the system memory management.
Response:
Troubleshoot system problem. If there is not enough memory available after the analysis engine shared memory block is allocated, then adjust the command line parameters.

rae_send_spool: Failed to unmap spool file: error reason
Description (ERR):
The spool file with previously mapped to memory was not unmapped when complete.
Response:
Troubleshoot system problem based on error reason.

rae_send_spool: Failed to remove spool file: error reason
Description (ERR):
The spool file was not successfully removed after having been completely read and transferred over the network.
Response:
Troubleshoot system problem based on error reason.

rae_recv_control: Invalid message size 'size
Description (ERR):
Message size is either negative or greater than the maximum allowed. Because the data cannot be verified, it is all discarded.
Response:
Verify configuration file was generated correctly.

rae_recv_control: Invalid message 'message
Description (ERR):
The message command is unrecognized. Because the data cannot be verified, it is all discarded.
Response:
Verify the message was generated correctly.

rae_recv_control: Error sending Control message to Manager error reason
Description (ERR):
Writing a message to the Spooler to Manager pipe failed.
Response:
Troubleshoot operating system problem based on the error reason.

rae_process_config: CFFL file 'filename too big
Description (ERR):
The configuration file name is greater than the allowed size. Because the data cannot be verified, it is all discarded.
Response:
Verify configuration file was generated correctly.

rae_process_config: Invalid CFFL file 'filename
Description (ERR):
The configuration file name is truncated in the command and there is no configuration data. Because the data cannot be verified, it is all discarded.
Response:
Verify configuration file was generated correctly.

rae_process_config: No data for configuration file 'filename
Description (ERR):
There is no data following a configuration file name.
Response:
Verify configuration file was generated correctly.

rae_process_config: Error opening configuration file 'filename: error reason
Description (ERR):
Attempting to open a configuration file failed.
Response:
Troubleshoot operating system problem based on the error reason.

rae_process_config: Error writing to configuration file 'filename': error reason
Description (ERR):
Writing the configuration to the specified file failed.
Response:
Troubleshoot operating system problem based on the error reason.

rae_process_config: Error sending Control message CFFL to Manager error reason
Description (ERR):
Writing a message to the Spooler to Manager pipe failed.
Response:
Troubleshoot operating system problem based on the error reason.

rae_poll: Failed to allocate net data structure: error reason
Description (ERR):
The Spooler does not use the Realeyes Analysis Engine memory management. Therefore the net data structure is allocated using the system allocation function. If there is an error, then there is a problem in the system memory management.
Response:
Troubleshoot system problem. If there is not enough memory available after the analysis engine shared memory block is allocated, then adjust the command line parameters.

spooler_main: Failed to allocate main Spooler structure
Description (ERR):
The Spooler does not use the Realeyes Analysis Engine memory management. Therefore the Spooler structure is allocated using the system allocation function. If there is an error, then there is a problem in the system memory management.
Response:
Troubleshoot system problem. If there is not enough memory available after the analysis engine shared memory block is allocated, then adjust the command line parameters.

spooler_main: Failed to set Spooler home as root: error reason
Description (ERR):
The Spooler was unable to read the fully qualified spool directory path or use it to set a chroot jail. Because the Spooler is the only process with network access, this may result in a security breach. It also implies that there are other problems.
Response:
Troubleshoot system problem based on error reason.

spooler_main: Error setting user IDerror reason
Description (ERR):
The attempt to set the user IP for the Spooler failed. The Spooler continues, but there may be a potential security breach.
Response:
Troubleshoot system problems based on the error reason.

spooler_main: Failed to open Event Analyzer to Spooler FIFO: error reason
Description (ERR):
Opening the FIFO for the Event Analyzer to notify the Spooler of Analysis Records failed. Since this is the primary purpose of the Spooler, it shuts down.
Response:
Troubleshoot system problem based on the error reason.

spooler_main: Event handler FIFO error
Description (WARN):
There was an error in the FIFO connecting the Spooler to the Event Handler. The Spooler continues processing, and will attempt to reopen the FIFO later.
Response:
Troubleshoot system problems.

spooler_main: Error in Analysis Record processor
Description (ERR):
Errors in the listener results in the rejection of a connection attempt.
Response:
See previous messages to troubleshoot error.

spooler_main: Error in Manager message processor
Description (ERR):
Errors in the manager pipe results in a restart of the Spooler.
Response:
See previous messages to troubleshoot error.

spooler_main: Control connection requested
Description (NOTE):
A control connection has been attempted.
Response:
None.

spooler_main: Data connection requested
Description (NOTE):
A data connection has been attempted.
Response:
None.

spooler_main: Control connection error
Description (WARN):
There was an error in the control connection. The Spooler continues processing, and will reopen the connection when a new request is received.
Response:
Troubleshoot network problems.

spooler_main: Data connection error
Description (WARN):
There was an error in the data connection. The Spooler continues processing, and will reopen the connection when a new request is received.
Response:
Troubleshoot network problems.

spooler_shutdown: Control listener not set for fast close: error reason
Description (ERR):
The attempt to set the socket to close immediately failed. The close will continue, but if the remote host is unable to respond, there may be problems when the application is restarted.
Response:
Troubleshoot operating system or network problem.

spooler_shutdown: Data listener not set for fast close: error reason
Description (ERR):
The attempt to set the socket to close immediately failed. The close will continue, but if the remote host is unable to respond, there may be problems when the application is restarted.
Response:
Troubleshoot operating system or network problem.

spooler_shutdown: Control session not set for fast close: error reason
Description (ERR):
The attempt to set the socket to close immediately failed. The close will continue, but if the remote host is unable to respond, there may be problems when the application is restarted.
Response:
Troubleshoot operating system or network problem.

spooler_shutdown: Data session not set for fast close: error reason
Description (ERR):
The attempt to set the socket to close immediately failed. The close will continue, but if the remote host is unable to respond, there may be problems when the application is restarted.
Response:
Troubleshoot operating system or network problem.
spooler_shutdown: Failed to detach circular buffer shared memory segment segment address, segment ID: error reason
Description (ERR): If the Spooler is unable to detach a circular buffer shared memory segment, it will have to be detached manually using the ipcrm command.
Response: Troubleshoot the system problem based on the error reason.

spooler_shutdown: Stopping Spooler
Description (NOTE):
Main Data Stream Analysis module signals all subcomponents to shutdown
Response:
None

Generated on Sat Apr 18 20:30:41 2009 for RealeyesIDS by doxygen 1.3.6