000037417 - RSA NetWitness Endpoint Agents go offline when scanning or initiating an action in a multi-server environment

Document created by RSA Customer Support Employee on May 28, 2019
Version 1Show Document
  • View in full screen mode

Article Content

Article Number000037417
Applies ToRSA Product Set: NetWitness Endpoint
RSA Product/Service Type: NetWitness Endpoint
RSA Version/Condition: 4.4.0.7
Platform: Windows
 
IssueA NWE multiserver environment with secondary servers is having flapping issues with the connectivity of online/offline machines where the machine on a secondary server suddenly goes offline when attempting to start a scan. Hitting refresh in the machines window eventually see's the machine return online.

It is impacted when a secondary server is decommissioned or otherwise changed within the environment.
CauseThe cause of this issue is a bug in the MSSQL view job that causes the machine to incorrectly appear offline in both the machines view and the individual machine window.
ResolutionThe permanent resolution to this issue is to upgrade to 4.4.1.0 where the bug fix is incorporated for this issue or upgrade to the 11.3+ version of Netwitness Log Hybrid.
WorkaroundClearing the cache on the UI or waiting for the machine to return online will show the machine as online again, but will not prevent it from going offline with a scan. Only upgrading to a fix version will prevent this issue.

Attachments

    Outcomes