000034305 - How to change the puppet node_id on RSA NetWitness Host

• NetWitness/SA Server (NetWitness/SA Broker headunit appliance or NetWitness/SA Server VM)
• All-In-One for Packets (AIO-P) appliances; and
• All-In-One for Logs (AIO-L) appliances

1. Change the basic networking (hostname and IP, if necessary) and reboot operating system
2. Generate a new puppet node_id
3. Re-trust the service which is typically done in the NetWitness/SA UI (Administration \ Appliances in SA 10.4.X and Administration \ Hosts in SA 10.5.X and later)

• 
  

  If you are running SA 10.6.0 and the puppet trust model is established (i.e. this host appears when you run 'mco ping' on puppetermaster.local) then you can SSH to the SA Server and use /etc/puppet/scripts/sysSetRPC/changePuppetMaster.py - https://community.rsa.com/docs/DOC-43221 this will update the mongo asg db correctly.
  Warning: If changing IP of host then script will reboot OS, if changing IP of server hosting puppetmaster.local, all hosts with trusted services will have their OS rebooted.

  
  
• Otherwise: Run the following script to change basic networking i.e. hostname and IP which will update /etc/hosts, /etc/sysconfig/network and /etc/sysconfig/network-scripts/ifcfg-e*
• 
  

  /usr/sbin/netconfig.sh

  
  
• Edit the line containing HWADDR in either /etc/sysconfig/network-scripts/ifcfg-em1 or / ifcfg-eth0 to match the MAC address of the current interface as seen in the following command:
• 
  

  ifconfig em1| grep -o "HWaddr .*" | awk '{ print $2 }'

  
  
• Note: If the command produces the following error message (which is common in the case of virtual machines),
• 
  

  em1: error fetching interface information: Device not found

  
  
• Then the command should be:
• 
  

  ifconfig eth0 | grep -o "HWaddr .*" | awk '{ print $2 }'

  
  
• Edit /etc/puppet/csr_attributes.yaml to update the fqdn and ipaddress values.
• If you have changed the IP of server hosting puppetmaster.local (and not used changePuppetMaster.py), then the static hostname entry in /etc/hosts for puppetmaster.local may need to be updated.
• (optional) For cloned VLCs remove the trustpeers for the Log Collector service to avoid issues in creating rabbitmq queues
• 
  

  find /etc/netwitness/ng/logcollector -type d -name trustpeers -exec rm -f {} \;
  

  
  
• Reboot the operating system (using either `shutdown -r now` or simply `reboot`) to use the new networking values

mv /var/lib/puppet/node_id /var/log/node_id.old.`date +"%Y%m%d_%H%M"`

/etc/puppet/scripts/node_id.py

new_node_id=$(/etc/puppet/scripts/node_id.py)

cat /var/lib/puppet/node_id

echo "$new_node_id" | tr -d '\r\n' > /var/lib/puppet/node_id

sed -ri "s/^certname = [a-z0-9\-]+/certname = $new_node_id/" /etc/puppet/puppet.conf

puppet agent -t --waitforcert 10

Notice: Did not receive certificate