Skip navigation
All Places > Products > RSA NetWitness Platform > RSA NetWitness Platform Online Documentation > Documents
Log in to create and rate content, and to follow, bookmark, and share content with other members.

Sys Maintenance: Troubleshooting New Health and Wellness

Document created by RSA Information Design and Development Employee on Jan 30, 2020Last modified by RSA Information Design and Development Employee on Nov 18, 2020
Version 14Show Document
  • View in full screen mode

This topic describes how to troubleshoot New Health and Wellness issues.


An error ‘n of m shards failed’ or ‘unknown field in the index’ in the New Health and Wellness dashboards.


Refresh the index patterns, perform the following:

  1. Log in to NetWitness Platform.
  2. Go to (Admin) > Health & Wellness.
  3. Click New Health & Wellness.
  4. Click Pivot to Dashboard.
  5. Go to Management > Index Patterns.
  6. Click nw* index pattern.
  7. Click Refresh to refresh the index pattern on top right corner.

Note: If the issue still persists, refresh other index patterns such as nw-metricbeat* or nw-concentrator* and so on.



Unable to send data to elastic search once disk usage reaches 85%.


If the Elasticsearch disk usage reaches 85%,

the saved objects (index patterns, dashboards, visualizations etc) becomes read-only mode.

And, services does not write new metrics to Elasticsearch or allow to edit any saved objects.

ResolutionTo change the indexes to write mode, execute the following command on the host in which Elasticsearch is installed:
curl -k --cert /etc/pki/nw/elastic/elasticsearch-cert.pem --key /etc/pki/nw/elastic/elasticsearch-key.pem -X PUT -H "Content-Type: application/json" -d '{"index.blocks.read_only_allow_delete": null }' https://localhost:9200/_all/_settings

Note: This command is supported only with certificates.


IssueNew Health and Wellness > Pivot to Dashboard fails due to time synchronization issue.
ExplanationPivot to dashboard fails if there is no time synchronization between the NetWitness Server and the host on which New Health and Wellness is installed.

You must synchronize the time and pivot to dashboard. To synchronize the time do one of the following:

  • Configure the NTP Server. For more information, see "Configure NTP Servers" in the System Configuration Guide.
  • Run the following commands on the host on which New Health and Wellness is installed
    1. SSH to NetWitness host.
    2. Run the following commands.
      • systemctl stop ntpd
      • ntpdate nw-node-zero
      • systemctl start ntpd

Next Topic:Appendices
You are here
Table of Contents > Health and Wellness > Monitor using New Health and Wellness > Troubleshooting Health and Wellness