This section describes solutions to problems that you may encounter during installations and upgrades. In most cases, NetWitness Platform creates log messages when it encounters these problems.
Note: If you cannot resolve an upgrade issue using the following troubleshooting solutions, contact Customer Support (https://community.rsa.com/docs/DOC-1294).
This section has troubleshooting documentation for the following services, features, and processes.
Go to the Master Table of Contents to find all RSA NetWitness Platform 11.x documents.
Command Line Interface (CLI)
Error Message | Command Line Interface (CLI) displays: "Orchestration failed." Mixlib::ShellOut::ShellCommandFailed: Command execution failed. STDOUT/STDERR suppressed for sensitive resource in/var/log/netwitness/config-management/chef-solo.log |
Cause | Entered the wrong deploy_admin password in nwsetup-tui. |
Solution | Retrieve your deploy_admin password.
|
Error Message | ERROR com.rsa.smc.sa.admin.web.controller.ajax.health. AlarmsController - Cannot connect to System Management Service |
Cause | NetWitness Platform sees the Service Management Service (SMS) as down after successful upgrade even though the service is running. |
Solution | Restart SMS service. systemctl restart rsa-sms |
Error Message | You receive a message in the User Interface to reboot the host after you update and reboot the host offline. |
Cause | You cannot use CLI to reboot the host. You must use the User Interface. |
Solution | Reboot the host in the Host View in the User Interface. |
Event Stream Analysis
- For ESA Correlation troubleshooting information, see the Alerting with ESA Correlation Rules User Guide.
- For ESA Analytics troubleshooting information, see the Automated Threat Detection Configuration Guide.
NetWitness UEBA
Problem | The User Interface is not accessible. |
Cause | You have more than one NetWitness UEBA service existing in your NetWitness deployment and you can only have NetWitness UEBA service in your deployment. |
Solution | Complete the following steps to remove the extra NetWitness UEBA service.
|