| Resolution | To find the installed version of a device's Log Parser file on a NetWitness Log Decoder.
ssh login to the Log Decoder.
The installed device types on the Log Decoder are under the /etc/netwitness/ng/envision/etc/devices directory.
A separate sub-directory exists for each device type.
For example,
# ll /etc/netwitness/ng/envision/etc/devices |head
total 1184
drwxr-xr-x. 294 root root 12288 Jul 11 2017 .
drwxr-xr-x. 2 root root 4096 Aug 26 2018 accurev
drwxr-xr-x. 2 root root 4096 Aug 26 2018 actiancevantage
drwxr-xr-x. 2 root root 4096 Aug 26 2018 actividentity
drwxr-xr-x. 2 root root 4096 Aug 26 2018 aforecloudlink
drwxr-xr-x. 2 root root 4096 Aug 26 2018 airdefense
drwxr-xr-x. 2 root root 4096 Aug 26 2018 airmagnet
drwxr-xr-x. 2 root root 4096 Aug 26 2018 airtightmc
drwxr-xr-x. 2 root root 4096 Aug 26 2018 aix
To display the installed version of a device's Log Decoder parser file, look at the "xml=" and "revision=" values near the top of the device's .xml file.
For example this aix device, the parser .xml file has values of xml="117" and revision="107",
# head /etc/netwitness/ng/envision/etc/devices/aix/*xml
<?xml version="1.0" encoding="ISO-8859-1"?>
<DEVICEMESSAGES>
<VERSION
xml="117"
checksum="44391d341c54c0f43bb5063c473c181e"
revision="107"
enVision="21050025"
device="2.0" />
<HEADER
Compare the above-found version values with the latest available for download from RSA Live in the NetWitness UI.
In the NetWitness UI go to,
NetWitness 11.x: Configure, Live Content tab
NetWitness 10.6.x: Live > Search
Search for the device type name in the Keyword field, or select "Log Device" under Resource Types to see all Log Decoder device types.
The Description field of each device type shows "Parser Version:" and "Event Source Update:" values, and are the latest version available for deployment to the Log Decoder.
Compare "Parser Version:" with "xml=" and compare "Event Source Update:" with "revision=".
For example, RSA Live shows the aix Parser Version: 136, Event Source Update: 130
In this example the aix device parser could do with a parser file update to the latest available version.
 |
on Jun 14, 2016