|Applies To||RSA Product Set: RSA NetWitness Platform|
RSA Product/Service Type: Core Appliance
RSA Version/Condition: 11.3.x
Platform: Cent OS
O/S Version: 7
|Issue||Respond service is unavailable in NetWitness GUI after upgrade from 11.2.0 to 18.104.22.168 as shown below.|
|Cause||For some reason, there exists ordering issue with the aggregation rules inside the mongo collection(aggregation_rule) after upgrade.|
You may see following error messages from respond log.
|Resolution||If there is no custom aggregation rule, then you can simply remove all the records from aggregation_rule collection.|
An aggregation_rule will be restored after restarting respond-server.
Follow the steps below to fix this issue.
(Note) ensure that you take backup your aggregation_rule using "mongodump" command before removing all the records.
switched to db respond-server
# systemctl start rsa-nw-respond-server.service
Once completed, you are able to see that the respond-server came up/online and it is showing up in the GUI as well.
If you are unsure of any of the steps above or experience any issues, contact RSA Support and quote this article number for further assistance.