Keyword search failure - AsynchChildren issue

Autopsy Help
1

I’m using Autopsy on Windows. Issue occurs on both 4.14 and 4.15. Recently, I started getting this error when running exact match keyword searches:

SEVERE: Unexpected error: Error, Error in RequestProcessor org.openide.nodes.AsynchChildren

It appears to affect ingest module keyword searches and ad hoc searches.

2020-06-19 07:53:23.879 org.sleuthkit.autopsy.ingest.DataSourceIngestJob logInfoMessage
INFO: Finished analysis (data source = LogicalFileSet1, objId = 1, jobId = 0)
2020-06-19 07:53:23.882 org.sleuthkit.autopsy.ingest.IngestManager finishIngestJob
INFO: Ingest job 0 completed
2020-06-19 07:59:08.1 org.sleuthkit.autopsy.exceptions.AutopsyExceptionHandler publish
SEVERE: Unexpected error: Error, Error in RequestProcessor org.openide.nodes.AsynchChildren

2

Are there any other messages in the autopsy.log file after the AsynchChildren line?
Can you reproduce this with some test data?

3

This is what I got today when running keyword search ingest module, as well as ad hoc keyword searches. The only keyword searches that work are not exact match -

2020-06-22 09:55:27.991 org.sleuthkit.autopsy.keywordsearch.Server isRunning
INFO: Solr server is running
2020-06-22 09:55:29.479 org.sleuthkit.autopsy.imagegallery.datamodel.DrawableDB setPragmas
INFO: sqlite-jdbc version 3.25.2 loaded in native mode
2020-06-22 09:55:29.512 org.sleuthkit.autopsy.casemodule.Case openAsCurrentCase
INFO: Opened XXXXXXXTest (XXXXXXXtest_20200619_071932) in G:\Shared\XXXXXXXQAServer_Only\XXXXXXXTest\XXXXXXXTest as the current case
2020-06-22 09:55:44.232 org.sleuthkit.autopsy.exceptions.AutopsyExceptionHandler publish
SEVERE: Unexpected error: Error, Error in RequestProcessor org.openide.nodes.AsynchChildren
2020-06-22 10:05:16.903 org.sleuthkit.autopsy.exceptions.AutopsyExceptionHandler publish
SEVERE: Unexpected error: Error, Error in RequestProcessor org.openide.nodes.AsynchChildren
Caused by: Expected mime type application/xml but got text/html.

Error 404 Not Found

HTTP ERROR 404

Problem accessing /solr/XXXXXXXtest_20200619_071932_20200619_071933/analysis/field. Reason: 

    Not Found
Powered by Jetty://



















2020-06-22 10:05:25.74 org.sleuthkit.autopsy.core.Installer
INFO: core installer created
2020-06-22 10:05:25.766 org.sleuthkit.autopsy.casemodule.Case closeCurrentCase
INFO: Closing current case XXXXXXXTest (XXXXXXXtest_20200619_071932) in G:\Shared\XXXXXXXQAServer_Only\XXXXXXXTest\XXXXXXXTest
2020-06-22 10:05:27.773 org.sleuthkit.autopsy.casemodule.Case closeAppServiceCaseResources
SEVERE: Solr Keyword Search Service service failed to open case resources
java.util.concurrent.ExecutionException: org.apache.solr.client.solrj.impl.HttpSolrServer$RemoteSolrException: No such core exists ‘XXXXXXXtest_20200619_071932_20200619_071933’
java.util.concurrent.FutureTask.report(FutureTask.java:122)
java.util.concurrent.FutureTask.get(FutureTask.java:192)
org.sleuthkit.autopsy.casemodule.Case.closeAppServiceCaseResources(Case.java:2637)
org.sleuthkit.autopsy.casemodule.Case.close(Case.java:2585)
org.sleuthkit.autopsy.casemodule.Case.lambda$doCloseCaseAction$9(Case.java:2514)
java.util.concurrent.FutureTask.run(FutureTask.java:266)
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
java.lang.Thread.run(Thread.java:748)
org.apache.solr.client.solrj.impl.HttpSolrServer$RemoteSolrException: No such core exists ‘XXXXXXXtest_20200619_071932_20200619_071933’
java.util.concurrent.FutureTask.report(FutureTask.java:122)
java.util.concurrent.FutureTask.get(FutureTask.java:192)
org.sleuthkit.autopsy.casemodule.Case.closeAppServiceCaseResources(Case.java:2637)
org.sleuthkit.autopsy.casemodule.Case.close(Case.java:2585)
org.sleuthkit.autopsy.casemodule.Case.lambda$doCloseCaseAction$9(Case.java:2514)
java.util.concurrent.FutureTask.run(FutureTask.java:266)
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
java.lang.Thread.run(Thread.java:748)
2020-06-22 10:05:27.775 org.sleuthkit.autopsy.imagegallery.ImageGalleryController shutDown
INFO: Shutting down image gallery controller for case XXXXXXXTest (XXXXXXXtest_20200619_071932)
2020-06-22 10:05:27.776 org.sleuthkit.autopsy.imagegallery.datamodel.DrawableDB close
INFO: Closing the drawable.db
2020-06-22 10:05:27.777 org.sleuthkit.autopsy.imagegallery.ImageGalleryController shutDown
INFO: Completed shut down of image gallery controller for case XXXXXXXTest (XXXXXXXtest_20200619_071932)

4

Based on that log snippet I don’t see how any keyword searches could be working. It looks like Solr cannot find the core for the case.
I would suggest that, with Autopsy shut down, you delete the Solr core.properties file for the case then restart Autopsy, open the case and try searching again.
The location of the Solr core.properties file depends on your installation but it can usually be found on Windows under %APPDATA%\autopsy\solr. In that location you should see a folder with the same name as your case and in that folder there may be a file named “core.properties”. You can either delete the “core.properties” file or the folder it lives in. It will be recreated when you re-open the case.

5

For reference, the internal tracking system ticket number for this issue is 6559.