Physical Host 10.6.6.x to 11.3 Upgrade: Appendix B. Stopping and Restarting Data Capture and Aggregation

RSA recommends that you stop network and log capture and aggregation before upgrading a Decoder, Concentrator, and Broker host to 11.3.0.2. If you do this, you must restart network and log capture and aggregation after updating these hosts.

Stop Data Capture and Aggregation

Stop Network Capture

1. Log in to NetWitness Platform and go to ADMIN > Services.
   The Services view is displayed.
2. Select each Decoder service.
   
   
3. Under (actions), select View > System.
   
4. In the toolbar, click .

Stop Log Capture

1. Log in to NetWitness Platform and go to ADMIN > Services.
   The Services view is displayed.
2. Select each Log Decoder service.
   
   
3. Under (actions), select View > System.
   
4. In the toolbar, click .

Stop Aggregation

1. Log in to NetWitness Platform and go to ADMIN > Services.

2. Select the Broker service.
3. Under (actions), select View > Config.
4. The General tab is displayed.
   
5. Under Aggregated Services click .

Start Data Capture and Aggregation

Restart network and log capture and aggregation after updating to 11.3.0.2.

Start Network Capture

1. Log in to NetWitness Platform and go to ADMIN > Services.
   The Services view is displayed.
2. Select each Decoder service.
   
3. Under (actions), select View > System.
   
4. In the toolbar, click .

Start Log Capture

1. Log in to NetWitness Platform and go to ADMIN > Services.
   The Services view is displayed.
2. Select each Log Decoder service.
   
3. Under (actions), select View > System.
   
4. In the toolbar, click .

Start Aggregation

1. Log in to NetWitness Platform and go to ADMIN > Services.
   The Services view is displayed.
2. For each Concentrator and Broker service.
   1. Select the service.
      
   2. Under (actions), select View > Config.
      
   3. In the toolbar, click .