|Applies To||RSA NetWitness NextGen|
RSA NetWitness Decoder
RSA NetWitness Log Decoder
RSA NetWitness Concentrator
RSA NetWitness Hybrid
RSA NetWitness Broker
RSA NetWitness Administrator
|Issue||Can't access an RSA NetWitness appliance due to "openWorker error Too many open files" messages.|
Unable to access your RSA NetWitness appliance via RSA NetWitness Administrator.
Errors similar to the following are observed in the /var/log/messages file:
The Netwitness process will need to be restarted before gaining access to the system.
|Resolution||Before restarting the service connect via SSH and run the following command:|
ps -ef | grep -i nw
Note the PID of the process in question (ie nwbroker nwconcentrator, nwdecoder) Then run the following..
ls -l /proc/$PID/fd
Where $PID is the process id of the service (Broker, Concentrator, Decoder). Paste the output of the directory listing in a support case for root cause analysis.
Once that information has been collected and provided to support, restart the process by using the stop/start command
stop (nwbroker nwconcentrator, nwdecoder) or monit stop (nwbroker nwconcentrator, nwdecoder)
start (nwbroker nwconcentrator, nwdecoder) or monit start (nwbroker nwconcentrator, nwdecoder)
You should now be able to access the appliance via NetWitness administrator.
|Legacy Article ID||a58666|