000032675 - RSA NetWitness appliance returns “Device eth0 does not seem to be present, delaying initialization” error while booting up

Document created by RSA Customer Support Employee on Jun 14, 2016Last modified by RSA Customer Support on May 7, 2019
Version 4Show Document
  • View in full screen mode

Article Content

Article Number000032675
Applies ToRSA Product Set: NetWitness Logs and Network
RSA Product/Service Type: Core Appliance
RSA Version/Condition: 10.x
Platform: CentOS
O/S Version: 6
IssueWhen customer receives RMA devices, they may follow an internal KB article How to move disks from an old RSA Security Analytics appliance to new or RMAed appliance without losing data to exchange disks and SD cards from old to the new appliance.

Once new appliance boots up, the interfaces would not come up. 

Running service network restart command will show below error. 

User-added image
CauseThis issue is due to the existing configuration is using old MAC details for the current new appliance.
  1. Remove networking interface rules file.
    rm /etc/udev/rules.d/70-persistent-net.rules
  2. Reboot the Server. During boot cycle, Need to enter IP address details for the appliance. The networking interface rules file which was removed in step#1 will be re-generated with new MAC addresses as below.
    # This file was automatically generated by the /lib/udev/write_net_rules
    # program, run by the persistent-net-generator.rules rules file.
    # You can modify it, as long as you keep each rule on a single
    # line, and change only the value of the NAME= key.
    # PCI device 0x8086:0x100e (e1000)
    SUBSYSTEM=="net", ACTION=="add", DRIVERS=="?*", ATTR{address}=="08:00:27:fe:c1:03", ATTR{type}=="1", KERNEL=="eth*", NAME="eth0"

  3. Edit /etc/sysconfig/network-scripts/ifcfg-eth0 file.
    - Comment in two lines starting with HWADDR= and UUID= if found.
    - Add a new line as MACADDR=<the new MAC address noted in step #2>
    e.g. MACADDR=08:00:27:fe:c1:03
  4. Run service network restart command which will show output as below.
    service network restart
    Shutting down interface eth0:                              [  OK  ]
    Shutting down loopback interface:                          [  OK  ]
    Bringing up loopback interface:                            [  OK  ]
    Bringing up interface eth0:  Determining if ip address X.X.X.X is already in use for device eth0...                                        [  OK  ]
  5. Appliance will be accessible from SSH console as well.
NotesThe same solution can be applied to other interfaces such as eth1 and eth2 (and more) by modifying the corresponding files, /etc/sysconfig/network-scripts/ifcfg-eth1 and /etc/sysconfig/network-scripts/ifcfg-eth2 respectively.