Cannot retrieve raw messages after upgrade

hoffa2000 · ‎09-30-2008

Hi folks

I get the message "Cannot retrieve raw message" when I try to view a raw event. Same problem for both FWSM and IPS.

Most annoying since the enhanced functionality of this feature was one of the main reasons to upgrade from 4.3.6 in the first place. What I can find in the backend log is "RawmsgBufferReader: read end of the buffer, not find two separators". That doesn't tell me anything more than that it might be a bug.

Any ideas?

Regards

Fredrik

irisrios · ‎10-06-2008

This may be because of shared buffer raw message are not in temporary file or data pool.

hoffa2000 · ‎10-06-2008

Is there something I can do as an end user?

/Fredrik