000038188 - nwsetup-tui script failed to restore from a backup file in RSA NetWitness.

Document created by RSA Customer Support Employee on Dec 3, 2019
Version 1Show Document
  • View in full screen mode

Article Content

Article Number000038188
Applies ToRSA Product Set: NetWitness Logs & Network
RSA Product/Service Type: Core Services
RSA Version/Condition:
Platform: CentOS
O/S Version: 7
IssueAfter migrating from Security Analytics 10.6.6.x to NetWitness, running nwsetup-tui script fails to restore from the backup file with the error message below.

2019-11-26 01:03:03 +0000 | 13132 | Restore /etc/netwitness/ng files.
2019-11-26 01:03:03 +0000 | 13132 | Error: Failed to restore /etc/netwitness/ng.
2019-11-26 01:03:03 +0000 | 13132 | Error: Failed to restore core device.
2019-11-26 01:03:10 +0000 | 13132 | Warning: Pre-bootstrap script completed with 1 errors. Please review the log file in /var/log/netwitness/upgrade/nw-pre-bootstrap-2019-11-26.log.

The issue occurs even with a valid backup file, hostname-x.x.x.x-backup.tar.gz, is located under /var/netwitness/database/nw-backup/ and all of the contents including hostname-x.x.x.x--etc-netwitness.tar.gz can be extracted without any issue.

ResolutionTo resolve the issue, manually extract /etc/netwitness/ng folder (or any other folder that is shown in the error message) from the backup file and copy the content to /var/netwitness/database/nw-backup/restore/ before running nwsetup-tui script again.

mkdir /tmp/restore
tar -zxvf /var/netwitness/database/nw-backup/hostname-x.x.x.x-backup.tar.gz -C /tmp/restore
tar -zxvf /tmp/restore/hostname-x.x.x.x--etc-netwitness.tar.gz -C /var/netwitness/database/nw-backup/restore

After confirming the contents are successfully extracted to /var/netwitness/database/nw-backup/restore/etc/netwitness/ng, run the nwsetup-tui script again.

If you are unsure of any of the steps above or experience any issues, contact RSA Support and quote this article number for further assistance.
NotesThe issue is noticed on core services but the same approach can be taken in case similar issues are noticed on other hosts.