Physical Host 10.6.6.x to 11.3 Upgrade: Appendix B. Stopping and Restarting Data Capture and Aggregation

Document created by RSA Information Design and Development on Apr 10, 2019•Last modified by RSA Information Design and Development on Jun 11, 2019

Version 3Show Document

Like • Show 0 Likes0
Comment • 0
View in full screen mode

RSA recommends that you stop network and log capture and aggregation before upgrading a Decoder, Concentrator, and Broker host to 11.3.0.0. If you do this, you must restart network and log capture and aggregation after updating these hosts.

Stop Data Capture and Aggregation

Stop Network Capture

Log in to NetWitness Platform and go to ADMIN > Services.
The Services view is displayed.
Select each Decoder service.
Under (actions), select View > System.
In the toolbar, click .

Stop Log Capture

Log in to NetWitness Platform and go to ADMIN > Services.
The Services view is displayed.
Select each Log Decoder service.
Under (actions), select View > System.
In the toolbar, click .

Stop Aggregation

Select the Broker service.
Under (actions), select View > Config.
The General tab is displayed.
Under Aggregated Services click .

Start Data Capture and Aggregation

Restart network and log capture and aggregation after updating to 11.3.0.0.

Start Network Capture

Log in to NetWitness Platform and go to ADMIN > Services.
The Services view is displayed.
Select each Decoder service.
Under (actions), select View > System.
In the toolbar, click .

Start Log Capture

Log in to NetWitness Platform and go to ADMIN > Services.
The Services view is displayed.
Select each Log Decoder service.
Under (actions), select View > System.
In the toolbar, click .

Start Aggregation

Log in to NetWitness Platform and go to ADMIN > Services.
The Services view is displayed.
For each Concentrator and Broker service.
1. Select the service.
1. Under (actions), select View > Config.
1. In the toolbar, click .