000029632 - How to reset the statistics on an RSA NetWitness Platform core services

Document created by RSA Customer Support Employee on Jun 14, 2016Last modified by RSA Customer Support on Sep 30, 2019
Version 5Show Document
  • View in full screen mode

Article Content

Article Number000029632
Applies ToRSA Product Set: RSA NetWitness Platform
RSA Product/Service Type: Core services
RSA Version/Condition: 10.x, 11.x
IssueResetting the stat DB may be required if a core service's stats are not updated with the current/expected values or for some other reasons.
The core service's stats can be viewed from the following locations.
For SA 10.x: Administration->Services->Explore(of the core service)->/<core service>/stats.
For NW 11.x: ADMIN-Services->Explore(of the core service)->/<core service>/stats.
e.x. /decoder/stats or /concentrator/stats.
TasksIn order to reset the statistics on a core service such as a decoder or a concentrator, please follow the steps below.
  1. In the Security Analytics UI or NetWitness UI, navigate to Administration(SA 10.x) or ADMIN(NW 11.x) -> Services.
  2. Select the core service, click on the Actions button, and select View ->Explore.
  3. In the Explore view, right-click on the core service directory in the left pane and select Properties.
  4. In the drop-down menu in the lower-right pane, select reset.
  5. In the Parameters field, enter stats=1 and click the Send button.
Be advised that resetting the statistics will automatically restart the core service on the appliance.

 User-added image
NotesAlternatively, the resetMax option may be used instead to only clear the maximum statistical values, such as capture.dropped.percent.max, capture.packet.rate.max, etc.
While it will not clear all statistics, it is the less intrusive option as it does not require a service restart to be performed.

User-added image