Azure Upgrade: Stop and Restart Data Capture and Aggregation

RSA recommends that you stop packet and log capture and aggregation before upgrading a Decoder, Concentrator, and Broker host to 11.3. If you do this, you must restart packet and log capture and aggregation after updating these hosts.

Stop Data Capture and Aggregation

Stop Packet Capture

To stop packet capture:

1. Log in to NetWitness Platform and go to ADMIN > Services.
   The Services view is displayed.
2. Select each Decoder service.
   
   
3. Under (actions), select View > System.
   
4. In the toolbar, click .

Stop Log Capture

To stop log capture:

1. Log in to NetWitness Platform and go to ADMIN > Services.
   The Services view is displayed.
2. Select each Log Decoder service.
   
   
3. Under (actions), select View > System.
   
4. In the toolbar, click .

Stop Aggregation

1. Log in to NetWitness Platform and go to ADMIN > Services.

2. Select the Broker service.
3. Under (actions), select View > Config.
4. The General tab is displayed.
   
5. Under Aggregated Services click .

Start Data Capture and Aggregation

Restart packet and log capture and aggregation after updating to 11.3.

Start Packet Capture

To start packet capture:

1. In the NetWitness Platform menu, select ADMIN > Services.
   The Services view is displayed.
2. Select each Decoder service.
   
3. Under (actions), select View > System.
   
4. In the toolbar, click .

Start Log Capture

To start log capture:

1. In the NetWitness Platform menu, select ADMIN > Services.
   The Services view is displayed.
2. Select each Log Decoder service.
   
3. Under (actions), select View > System.
   
4. In the toolbar, click .

Start Aggregation

During the upgrade from 10.6.6.x to 11.3, the Broker Service is restarted and this automatically starts aggregation.