000015027 - NWD file is corrupt when attempting to pull a session in RSA NetWitness Investigator

Document created by RSA Customer Support Employee on Jun 16, 2016Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 2Show Document
  • View in full screen mode

Article Content

Article Number000015027
Applies ToRSA NetWitness NextGen
RSA NetWitness NextGen 8.6
RSA NetWitness Decoder
RSA NetWitness Concentrator
RSA NetWitness Investigator
IssueNWD file is corrupt when attempting to pull a session in RSA NetWitness Investigator.
When working in Investigator and attempting to view a session, a window pops up indicating that the nwd file is corrupt for a particular session.
Resolution

If this issue is related to a local collection delete the content cache within Investigator by going to Collection (top left) and then select delete content cache.

If the issue is occurring on a remote collection and deleting the Investigator cache does not resolve, delete the contents of the cache directory on the concentrator/decoder which can be found in the following locations: 

On the Concentrator

/home/NetWitness/concentrator/Cache

On the Decoder

/home/NetWitness/decoder/Cache

***Please note that you are only to delete the contents of the cache directory, not the directory itself.***

Legacy Article IDa58580

Attachments

    Outcomes