OC Admin Error Messages

The page below provides explanations for several different error messages that might appear while using OC Admin.

Unknown error. See Console.

To access the Console:

With Chrome:

Click the three-dot menu in the top right corner of the window.
Select More Tools.
Select Developer Tools.
Click Console.
Scroll to the bottom.

With Firefox:

Click the three horizontal-line menu in the top right corner of the window.
Select Web Developer.
Select Web Console.
Scroll to the bottom.

With Edge:

Click the three-dot menu in the top right corner of the window.
Select More Tools.
Select Developer Tools.
Click Console.
Scroll to the bottom.

With Safari:

Click the Develop menu.
Select Show Web Inspector.
Click Console.
Scroll to the bottom.

If you don’t see the Develop menu in the menu bar:

Click the Safari menu.
Select Preferences.
Click Advanced.
Select Show Develop menu in menu bar.

Error Message 208

Invalid object name 'LogRhythmEMDB.dbo.MsgSource'.

Invalid object name 'LogRhythmEMDB.dbo.SCLicense'.

Summary

The Hostname or IP address specified for the Platform Manager or XM points to a system where the SIEM database (EMDB) doesn't exist.

Solution

Try again with a different Hostname or IP address where the SIEM database (EMDB) does exist.

Error Message 51001

User Login already exists. OC Admin only uses new User Login.

Summary

To prevent impacting other applications (including LogRhythm and MS SQL itself), EZ Server will not allow you to create or use a user account that is used by something else.

Examples of typically forbidden User Accounts:

LogRhythmAdmin
LogRhythmAIEDrillDownCache
LogRhythmAnalyst
LogRhythmLM
LogRhythmARM
LogRhythmJobMgr
LogRhythmAIE
LogRhythmWebUI
LogRhythmCaseAPI
LogRhythmNotification
LogRhythmCaseAPIAdmin
LogRhythmCaseAPIMaintenance
LogRhythmNGLM
<Your_Machine_Name>\Administrator
Administrator
sa
public
sysadmin
securityadmin
serveradmin
setupadmin
processadmin
diskadmin
dbcreator
bulkadmin
##MS_SQLResourceSigningCertificate##
##MS_SQLReplicationSigningCertificate##
##MS_SQLAuthenticatorCertificate##
##MS_PolicySigningCertificate##
##MS_SmoExtendedSigningCertificate##
##MS_PolicyTsqlExecutionLogin##
BUILTIN\Administrators
NT SERVICE\SQLWriter
NT SERVICE\Winmgmt
NT Service\MSSQLSERVER
NT AUTHORITY\SYSTEM
NT SERVICE\SQLSERVERAGENT
NT SERVICE\SQLTELEMETRY
##MS_PolicyEventProcessingLogin##
##MS_AgentSigningCertificate##

Solution

Try again with a different Username that is not already in use on your SQL server.

EPARAM

Generic SQL Backend error - Stored Procedure Parameter

Summary

An internal error caused one or more parameter(s) for a stored procedure to be missing, corrupt, or incomplete.

Solution

Raise an Issue for this type of error message, copying and pasting the message and as much detail as possible.

EINVALIDSTATE

Requests can only be made in the LoggedIn state, not the SentLogin7WithStandardLogin state

Summary

The Hostname or IP address specified for the Platform Manager or XM points to a non-existing system.

Solution

Try again with a different Hostname or IP address for the Platform Manager or XM.

ErrorQueryingPersistanceLayer

Generic SQL Backend error - Error querying persistance layer.

Summary

An internal error or mishap caused the result of one or more SQL statements to be missing, corrupt, or incomplete.

Solution

Raise an Issue for this type of error message, copying and pasting the message and as much detail as possible.

NoLiveSocket

Live (Socket) connection with the OC Admin Server has been lost or is not currently established.

Summary

There are several ways this error could be triggered:

The browser page was refreshed since the last Login.
The user has been logged for a long time and the session's authentication token has expired.
If using a self-signed HTTPS certificate on the server (default behavior), the web browser may have stopped trusting it.
The OC Admin server machine is unreachable.
The OC Admin container is not running.

Solution

Because there are several possible causes, try the following steps in order to attempt to fix the issue.

Logout and log back in.
Refresh the page and re-accept the self-signed certificate.
Check the OC Admin container is still running on the OC Admin server:
CODE
```
docker ps | grep "oc-admin"
```
Check that the OC Admin server is ON and reachable.

TailFailedToStart

Tail could not start due to no live socket available.

Summary

Tail needs a live socket connection to communicate between the OC Admin client and the OC Admin server, and it was not the case at this time.

When not connected, an orange barred cloud is displayed in the left-hand menu bar.

Solution

Make sure the socket is established before trying to run the Tail.

Refer to the NoLiveSocket section for more information.

ShipperInstallFailedToStart

Shipper deployment could not start due to no live socket available.

Summary

The shipper installation needs a live socket connection to communicate between the OC Admin client and the OC Admin server, and it was not the case at this time.

When not connected, an orange barred cloud is displayed in the left hand side menu bar.

Solution

Make sure the Socket is established before trying to install the shipper.

Refer to the NoLiveSocket section for more information.

BadFileExtentionImportCollection

Only .ezCollection files are accepted.

Summary

The file being imported is either not a shared collection configuration file, or its extension has been modified and is not .ezCollection anymore.

This file must a proper shared collection configuration file.

Solution

Obtain a valid and non-renamed shared collection configuration file.

Refer to the Sharing/Importing Collection Configurations section of the OC Admin Collection Configuration topic for more information.

TooManyFilesImportCollection

Only one .ezCollection file is accepted.

Summary

An attempt was made to import more than one shared collection configuration file at a time.

OC Admin can only import one shared collection configuration file per pipeline.

Solution

Try again with only one shared collection configuration file.

Refer to the Sharing/Importing Collection Configurations section of the OC Admin Collection Configuration topic for more information.

CantReadFileImportCollection

Error trying to open FILENAME file.

Summary

There are many possible reasons to trigger this error message, including file access denied, file not present anymore, and directory not readable, among others.

Solution

Perform the following steps:

Read the rest of the error message, as it might provide the reason for the failure.
Attempt to fix the issue.
Try the import again.

Refer to the Sharing/Importing Collection Configurations section of the OC Admin Collection Configuration topic for more information.

CantParseFileImportCollection

Error trying to parse the content of undefined file.

Summary

The file being imported is either not a shared collection configuration file, or it is corrupted.

This file must contain a properly formatted JSON export of a collection configuration.

Solution

Obtain a valid and non-corrupted shared collection configuration file.

Refer to the Sharing/Importing Collection Configurations section of the OC Admin Collection Configuration topic for more information.

BadFileExtentionImportMapping

Only .ezFieldsMapping files are accepted.

Summary

The file being imported is either not a shared fields mapping file, or its extension has been modified and is not .ezFieldsMapping any more.

This file must a proper shared fields mapping file.

Solution

Obtain a valid and non-renamed shared fields mapping file.

Refer to the Sharing/Importing Fields Mapping section of the OC Admin Mapping Editor topic for more information.

TooManyFilesImportMapping

Only one .ezFieldsMapping file is accepted.

Summary

You tried to import more than one shared fields mapping file at a time.

OC Admin can only import one shared fields mapping file per pipeline.

Solution

Try again with only one shared fields mapping file.

Refer to the Sharing/Importing Fields Mapping section of the OC Admin Mapping Editor topic for more information.

CantReadFileImportMapping

Error trying to open FILENAME file.

Summary

There are many possible reasons to trigger this error message, including file access denied, file not present anymore, and directory not readable, among others.

Solution

Perform the following steps:

Read the rest of the error message, as it might provide the reason for the failure.
Attempt to fix the issue.
Try the import again.

Refer to the Sharing/Importing Fields Mapping section of the OC Admin Mapping Editor topic for more information.

CantParseFileImportMapping

Error trying to parse the content of undefined file.

Summary

The file you tried to import is either not a shared fields mapping file, or it is corrupted.

This file must contain a properly formatted JSON export of a fields mapping.

Solution

Obtain a valid and non-corrupted shared fields mapping file.

Refer to the Sharing/Importing Fields Mapping section of the OC Admin Mapping Editor topic for more information.

If you found a mistake, have a suggestion, want to help/contribute, or cannot find what you were looking for, please get in touch and raise an Issue.