|Applies To||RSA Product Set: NetWitness Logs & Network|
RSA Product/Service Type: Core Services
RSA Version/Condition: 22.214.171.124
O/S Version: 7
|Issue||After migrating from Security Analytics 10.6.6.x to NetWitness 126.96.36.199, running nwsetup-tui script fails to restore from the backup file with the error message below.|
The issue occurs even with a valid backup file, hostname-x.x.x.x-backup.tar.gz, is located under /var/netwitness/database/nw-backup/ and all of the contents including hostname-x.x.x.x--etc-netwitness.tar.gz can be extracted without any issue.
|Resolution||To resolve the issue, manually extract /etc/netwitness/ng folder (or any other folder that is shown in the error message) from the backup file and copy the content to /var/netwitness/database/nw-backup/restore/ before running nwsetup-tui script again.|
tar -zxvf /var/netwitness/database/nw-backup/hostname-x.x.x.x-backup.tar.gz -C /tmp/restore
tar -zxvf /tmp/restore/hostname-x.x.x.x--etc-netwitness.tar.gz -C /var/netwitness/database/nw-backup/restore
After confirming the contents are successfully extracted to /var/netwitness/database/nw-backup/restore/etc/netwitness/ng, run the nwsetup-tui script again.
If you are unsure of any of the steps above or experience any issues, contact RSA Support and quote this article number for further assistance.
|Notes||The issue is noticed on core services but the same approach can be taken in case similar issues are noticed on other hosts.|