Hello,
Some problems pop up when I have finished to ingest my case of ~80 go. All of the keyword searching request shows me this error window and can’t execute my request.
I have tried Autopsy 4.14 and 4.15, the bug is the same so I think it comes from Solr.
I should notice that have modified the maximum JVM Memory to 8 go. I have interrupted an ingest to do so and I have rerun it after. The error has appeared 12 hour after when the ingest terminates the last percentage.
If I check the port of Solr, I found the following live logs (http://localhost:23232/solr/#/~logging) :
What I have tried :
-I have run another smaller case, the bug appears, and I have unloaded the Core on Solr. Then the keyword searching works, but the logs on Solr still signals an error. Then I’ve tried it on my current case, that is larger, but it doesn’t work.
-Restart Autopsy
-Change the number of Go allocated to JVM Memory
I wanted to upload my logs but apparently this is not authorized (…)
So… The number of characters are limited too… I provide you an extract of the logs that I’m thinking interesting…
…
Compiler: HotSpot 64-Bit Tiered Compilers
Heap memory usage: initial 24.0MB maximum 4096.0MB
Non heap memory usage: initial 2.4MB maximum -1b
Garbage collector: G1 Young Generation (Collections=65 Total time spent=0s)
Garbage collector: G1 Old Generation (Collections=0 Total time spent=0s)
Classes: loaded=8565 total loaded=8565 unloaded 0
INFO [org.netbeans.core.ui.warmup.DiagnosticTask]: Total memory 17’023’479’808
INFO [null]: Total physical memory 17’023’479’808
WARNING [org.openide.filesystems.Ordering]: Found same position 1’400 for both Menu/Tools/org-netbeans-modules-autoupdate-ui-actions-PluginManagerAction.shadow and Menu/Tools/org-sleuthkit-autopsy-actions-OpenPythonModulesFolderAction.shadow
WARNING [org.openide.filesystems.Ordering]: Found same position 200 for both Menu/Tools/Separator1.instance and Menu/Tools/org-sleuthkit-autopsy-filesearch-FileSearchAction.shadow
WARNING [org.openide.filesystems.Ordering]: Found same position 102 for both Menu/Tools/org-sleuthkit-autopsy-communicationsVisualization-OpenCVTAction.shadow and Menu/Tools/org-sleuthkit-autopsy-geolocation-OpenGeolocationAction.shadow
WARNING [org.openide.filesystems.Ordering]: Found same position 102 for both Menu/Tools/org-sleuthkit-autopsy-communicationsVisualization-OpenCVTAction.shadow and Menu/Tools/org-sleuthkit-autopsy-timeline-Timeline.shadow
WARNING [org.openide.filesystems.Ordering]: Found same position 102 for both Menu/Tools/org-sleuthkit-autopsy-geolocation-OpenGeolocationAction.shadow and Menu/Tools/org-sleuthkit-autopsy-timeline-Timeline.shadow
17393 [MLog-Init-Reporter] INFO com.mchange.v2.log.MLog - MLog clients using slf4j logging.
INFO [org.netbeans.core.windows.persistence]: [PersistenceManager.getTopComponentForID] Problem when deserializing TopComponent for tcID:‘Listing’. Reason: Top component Listing could not be located or loaded from Components folder.
WARNING [org.openide.filesystems.Ordering]: Could not find both sides of relative ordering attribute master-help.xml/org-sleuthkit-autopsy-corecomponents-CustomAboutAction.shadow on Menu/Help
18532 [nationaltreasure_20200514_001259-case-action] INFO com.mchange.v2.c3p0.C3P0Registry - Initializing c3p0-0.9.5 [built 02-January-2015 13:25:04 -0500; debug? true; trace: 10]
19283 [nationaltreasure_20200514_001259-case-action] INFO com.mchange.v2.c3p0.impl.AbstractPoolBackedDataSource - Initializing c3p0 pool… com.mchange.v2.c3p0.PoolBackedDataSource@68f37630 [ connectionPoolDataSource -> com.mchange.v2.c3p0.WrapperConnectionPoolDataSource@eb872bf2 [ acquireIncrement -> 2, acquireRetryAttempts -> 30, acquireRetryDelay -> 1000, autoCommitOnClose -> false, automaticTestTable -> null, breakAfterAcquireFailure -> false, checkoutTimeout -> 0, connectionCustomizerClassName -> null, connectionTesterClassName -> com.mchange.v2.c3p0.impl.DefaultConnectionTester, contextClassLoaderSource -> caller, debugUnreturnedConnectionStackTraces -> false, factoryClassLocation -> null, forceIgnoreUnresolvedTransactions -> false, identityToken -> 1bqx6pkaa5xymtynp1xs5|3c4819e, idleConnectionTestPeriod -> 0, initialPoolSize -> 5, maxAdministrativeTaskTime -> 0, maxConnectionAge -> 0, maxIdleTime -> 0, maxIdleTimeExcessConnections -> 0, maxPoolSize -> 20, maxStatements -> 200, maxStatementsPerConnection -> 20, minPoolSize -> 5, nestedDataSource -> org.sqlite.SQLiteDataSource@18180da1, preferredTestQuery -> null, privilegeSpawnedThreads -> false, propertyCycle -> 0, statementCacheNumDeferredCloseThreads -> 0, testConnectionOnCheckin -> false, testConnectionOnCheckout -> false, unreturnedConnectionTimeout -> 0, usesTraditionalReflectiveProxies -> false; userOverrides: {} ], dataSourceName -> null, extensions -> {}, factoryClassLocation -> null, identityToken -> 1bqx6pkaa5xymtynp1xs5|6722db2f, numHelperThreads -> 3 ]
INFO [org.sleuthkit.datamodel.SleuthkitCase]: Time to initialize parent node cache: 183 ms
INFO [org.sleuthkit.datamodel.SleuthkitCase]: sqlite-jdbc version 3.25.2 loaded in native mode
WARNING [org.netbeans.modules.autoupdate.updateprovider.AutoupdateCatalogParser]: http://sleuthkit.org/autopsy/updates.xml:12:2: Le balisage du document suivant l’élément racine doit avoir un format correct.
SEVERE [org.openide.util.RequestProcessor]: Error in RequestProcessor org.openide.nodes.AsynchChildren
java.lang.NullPointerException
at java.util.HashMap.putMapEntries(HashMap.java:501)
at java.util.HashMap.putAll(HashMap.java:785)
at org.sleuthkit.autopsy.keywordsearch.LuceneQuery.performQuery(LuceneQuery.java:146)
at org.sleuthkit.autopsy.keywordsearch.AdHocSearchChildFactory.createFlatKeys(AdHocSearchChildFactory.java:157)
at org.sleuthkit.autopsy.keywordsearch.AdHocSearchChildFactory.createKeys(AdHocSearchChildFactory.java:130)
at org.openide.nodes.AsynchChildren.run(AsynchChildren.java:215)
at org.openide.util.RequestProcessor$Task.run(RequestProcessor.java:1443)
at org.netbeans.modules.openide.util.GlobalLookup.execute(GlobalLookup.java:68)
at org.openide.util.lookup.Lookups.executeWith(Lookups.java:303)
[catch] at org.openide.util.RequestProcessor$Processor.run(RequestProcessor.java:2058)
WARNING: System properties and/or JVM args set. Consider using --dry-run or --exec
0 [main] WARN org.eclipse.jetty.server.handler.RequestLogHandler – !RequestLog
16600 [qtp1358444045-13] ERROR org.apache.solr.core.CoresLocator – Couldn’t persist core properties to C:\Program Files\Autopsy-4.14.0\autopsy\solr\solr\nationaltreasure_20200514_001259_20200514_001300\core.properties: java.io.FileNotFoundException: solr\nationaltreasure_20200514_001259_20200514_001300\core.properties (Le chemin d’accès spécifié est introuvable)
16661 [qtp1358444045-13] WARN org.apache.solr.core.SolrResourceLoader – Can’t find (or read) directory to add to classloader: …/…/…/contrib/extraction/lib (resolved as: C:\Program Files\Autopsy-4.14.0\autopsy\solr\solr\configsets\AutopsyConfig…\contrib\extraction\lib).
16661 [qtp1358444045-13] WARN org.apache.solr.core.SolrResourceLoader – Can’t find (or read) directory to add to classloader: …/…/…/dist/ (resolved as: C:\Program Files\Autopsy-4.14.0\autopsy\solr\solr\configsets\AutopsyConfig…\dist).
16661 [qtp1358444045-13] WARN org.apache.solr.core.SolrResourceLoader – Can’t find (or read) directory to add to classloader: …/…/…/contrib/clustering/lib/ (resolved as: C:\Program Files\Autopsy-4.14.0\autopsy\solr\solr\configsets\AutopsyConfig…\contrib\clustering\lib).
16661 [qtp1358444045-13] WARN org.apache.solr.core.SolrResourceLoader – Can’t find (or read) directory to add to classloader: …/…/…/dist/ (resolved as: C:\Program Files\Autopsy-4.14.0\autopsy\solr\solr\configsets\AutopsyConfig…\dist).
16661 [qtp1358444045-13] WARN org.apache.solr.core.SolrResourceLoader – Can’t find (or read) directory to add to classloader: …/…/…/contrib/langid/lib/ (resolved as: C:\Program Files\Autopsy-4.14.0\autopsy\solr\solr\configsets\AutopsyConfig…\contrib\langid\lib).
16662 [qtp1358444045-13] WARN org.apache.solr.core.SolrResourceLoader – Can’t find (or read) directory to add to classloader: …/…/…/dist/ (resolved as: C:\Program Files\Autopsy-4.14.0\autopsy\solr\solr\configsets\AutopsyConfig…\dist).
16662 [qtp1358444045-13] WARN org.apache.solr.core.SolrResourceLoader – Can’t find (or read) directory to add to classloader: …/…/…/contrib/velocity/lib (resolved as: C:\Program Files\Autopsy-4.14.0\autopsy\solr\solr\configsets\AutopsyConfig…\contrib\velocity\lib).
16662 [qtp1358444045-13] WARN org.apache.solr.core.SolrResourceLoader – Can’t find (or read) directory to add to classloader: …/…/…/dist/ (resolved as: C:\Program Files\Autopsy-4.14.0\autopsy\solr\solr\configsets\AutopsyConfig…\dist).
16662 [qtp1358444045-13] WARN org.apache.solr.core.SolrResourceLoader – Can’t find (or read) directory to add to classloader: /total/crap/dir/ignored (resolved as: C:\Program Files\Autopsy-4.14.0\autopsy\solr\solr\configsets\AutopsyConfig\total\crap\dir\ignored).
16919 [qtp1358444045-13] WARN org.apache.solr.core.SolrResourceLoader – Solr loaded a deprecated plugin/analysis class [solr.IntField]. Please consult documentation how to replace it accordingly.
16921 [qtp1358444045-13] WARN org.apache.solr.core.SolrResourceLoader – Solr loaded a deprecated plugin/analysis class [solr.LongField]. Please consult documentation how to replace it accordingly.
16922 [qtp1358444045-13] WARN org.apache.solr.core.SolrResourceLoader – Solr loaded a deprecated plugin/analysis class [solr.FloatField]. Please consult documentation how to replace it accordingly.
16926 [qtp1358444045-13] WARN org.apache.solr.core.SolrResourceLoader – Solr loaded a deprecated plugin/analysis class [solr.DoubleField]. Please consult documentation how to replace it accordingly.
16930 [qtp1358444045-13] WARN org.apache.solr.core.SolrResourceLoader – Solr loaded a deprecated plugin/analysis class [solr.DateField]. Please consult documentation how to replace it accordingly.
16932 [qtp1358444045-13] WARN org.apache.solr.core.SolrResourceLoader – Solr loaded a deprecated plugin/analysis class [solr.SortableIntField]. Please consult documentation how to replace it accordingly.
16933 [qtp1358444045-13] WARN org.apache.solr.core.SolrResourceLoader – Solr loaded a deprecated plugin/analysis class [solr.SortableLongField]. Please consult documentation how to replace it accordingly.
16935 [qtp1358444045-13] WARN org.apache.solr.core.SolrResourceLoader – Solr loaded a deprecated plugin/analysis class [solr.SortableFloatField]. Please consult documentation how to replace it accordingly.
16937 [qtp1358444045-13] WARN org.apache.solr.core.SolrResourceLoader – Solr loaded a deprecated plugin/analysis class [solr.SortableDoubleField]. Please consult documentation how to replace it accordingly.
17551 [qtp1358444045-13] WARN org.apache.solr.rest.ManagedResource – No stored data found for /rest/managed
17551 [qtp1358444045-13] WARN org.apache.solr.rest.ManagedResource – No registered observers for /rest/managed
And I was wondering what was this file that takes 4 Go
A heap dump ?
I hope that all you need to find something interesting.
Thanks for reading.
Good night.
