000037619 - Dashboards disappearing after updating to RSA NetWitness Logs & Network 11.2.1.1

Document created by RSA Customer Support Employee on Jun 13, 2019
Version 1Show Document
  • Comment • 0
  • View in full screen mode

Article Content

Article Number000037619
Applies ToRSA Product Set: NetWitness Logs & Network
RSA Version/Condition: 11.2.x, 11.2.1.1
Platform: CentOS
O/S Version: 7

 
IssueSome customers observe an issue where after updating to 11.2.1, they can only view the Default dashboard. Their custom dashboards including the OOTB dashboards have disappeared and even though you create new dashboards, after logging out you are not able to access them via the Netwitness UI. 
CauseThe issue points to some corrupted Dashlets which does contain null values for parameters such as "ipLimit" 
Resolution
  1. Take a backup of the current Dashboards and Dashlet mongo collections from the Admin Server -
    SSH to the Admin Server and run the below two commands; 
    Replace the {deploy_admin_password} with your current deploy_admin user password.

    mongoexport --ssl --sslAllowInvalidHostnames -u deploy_admin -p {deploy_admin_password} --authenticationDatabase admin --db sa --collection dashboard --out /root/dashboard.json

    mongoexport --ssl --sslAllowInvalidHostnames -u deploy_admin -p {deploy_admin_password} --authenticationDatabase admin --db sa --collection dashlet --out /root/dashlet.json


    Note: If you do not know your current deploy_admin password, you should be able to obtain that by using the below command;


    security-cli-client --get-config-prop --prop-hierarchy nw.security-client --prop-name platform.deployment.password --quiet



    Two files will be saved in /root as dashboard.json & dashlet.json respectively.
     
  2. Check the dashlet.json file for any null parameters -

    grep -E 'ipLimit|null' --color=always

    For example, you may seen an entry such as the one below; 


    {"_id":{"$oid":"<DASHLET_OBJECT_ID>"},"_class":"com.rsa.smc.sa.common.dashboard.domain.model.Dashlet","dashboardId":"<DASHBOARD_ID>","dashletClass":"UAP.dashboard.dashlet.reporting.ReporterChartDashlet","column":1,"row":0,"options":{"unifiedDashboard":"true","ifInetType":"","dashboardLink":"NONE","refreshInterval":"15","title":"<TITLE>","dashletClass":"UAP.dashboard.dashlet.reporting.ReporterChartDashlet","pastHours":"72","chartId":"<CHART_ID>"chartName":"<CHART_NAME>","seriesType":"TIME_SERIES","chartType":"LINE","limit":"5","ipLimit":null},"linkedDashboards":[]}


    In here the "ipLimit" parameter is set to null as highlighted. The value needs to be changed to an entry such as "10". 
     
  3. Note the  <DASHLET_OBJECT_ID> from the above command by analyzing the dashlet.json file and change the entry in the mongo database 'sa' and collection 'dashlet'
    Login to the mongo database 

    # mongo admin -u deploy_admin -p {deploy_admin_password} --authenticationDatabase admin

    > use sa


    To check if the Dashlet object ID we have found is correct;
     

    > db.dashlet.find({_id:ObjectId("<DASHLET_OBJECT_ID>")}).pretty()


    Changing the "ipLimit":null to "ipLimit":"10"
     

    > db.dashlet.updateOne({_id:ObjectId("<DASHLET_OBJECT_ID>"),"options.ipLimit":null},{$set:{"options.ipLimit":"10"}})


    To verify the changes; 

    > db.dashlet.find({_id:ObjectId("<DASHLET_OBJECT_ID>")}).pretty()

    > exit

  4. Restart the relevant services.
     

    # systemctl restart mongod

    # systemctl restart jetty

  5. After the jetty service restarts and the User Interface comes up, You may see the Custom and OOTB dashboards appearing again. However, you may also see many "Default Dashboard" entries.
    To fix that, Select the Default Dashboard

    Click on restore the default dashboard icon ( User-added image ) to its original layout in the Netwitness UI

    Logout from the Current user and Log back in.



     

Attachments

    Outcomes