000037796 - Start/Stop Capture button is disabled on the Decoder service in RSA NetWitness Platform version 11.3.x

Document created by RSA Customer Support Employee on Aug 7, 2019Last modified by RSA Customer Support Employee on Sep 2, 2019
Version 2Show Document
  • View in full screen mode

Article Content

Article Number000037796
Applies ToRSA Product Set: NetWitness Logs & Network
RSA Product/Service Type: NetWitness UI
RSA Version/Condition: 11.3.x
Platform: CentOS
O/S Version: 7
IssueThe Start/Stop Capture button is disabled and the Decoder "Service Information" section is missing on the Decoder > System page within the RSA NetWitness version 11.3.x UI.
CauseFailure to complete the "service?" AJAX call and load the service's license information.
Resolution
  1. SSH to the node zero server to restart the License Server using the following commands:

    # systemctl stop rsa-nw-license-server

    # systemctl start rsa-nw-license-server


    Running the following command to tail the license-server.log file while restarting the license server will help indicate any further license issues that may be occurring. 


    # tail -f /var/log/netwitness/license-server/license-server.log

  2. Within the RSA NetWitness UI, navigate to the Admin > Services > Decoder > View > System page.
  3. Refresh the System page.

  • The "Start/Stop Capture" button should be enabled
  • The Decoder "Service Information" section should appear, as well.
If the above steps do not work:

  1. Look at one of the "appliance?" AJAX calls to see if you are seeing null values for fields such as "deviceVersion", "startDate", and/or "licenseInfo."
  2. Look through sa.log for the following error, which refers to the null values above: 

    org.springframework.web.util.NestedServletException: Request processing failed; nested exception is java.lang.NullPointerException

  3. Navigate to Admin > System > Licensing to see if there are any licenses available.
  4. This issue is happening because the SA Server is unable to fetch the license information. You will need to upload a new offline response file into Admin > System > Licensing > Settings > Step 2: "Upload Offline Response File."

  • The licenses should now appear under Admin > System > Licensing, if they were previously missing.
  • The "Start/Stop Capture" button should be enabled.
  • The Decoder "Service Information" section should appear, as well.
NotesIf you open the Developer Tools > Network tab in your browser window when you are within the System page for any RSA NetWitness core service, there are 4 AJAX calls to pay attention to:
  • service?: This corresponds to the service's "System Information." section. This will also display the service's license information.
  • user?: This corresponds to the service's "User Information" section.
  • appliance?: This corresponds to the service's "Appliance Service Information" section.
  • appliance?: This next "appliance?" request corresponds to the service's "Host User Information" section.
In this case, the system's "Service Information" section will be blank within the RSA NetWitness UI. Within the browser's Developer Tools > service? AJAX call, it will display a "Status Code: 500 Error" because the SA Server is unable to communicate with the License Server. If there are no communication errors between the License Server and the SA Server, there may be communication issues between the service and the SA Server - look through the /var/netwitness/uax/logs/sa.log file for further information.


If this does not solve your issue, please open a case with RSA Technical Support and reference this article so that we may better assist you.

Attachments

    Outcomes