000016514 - Partition and sizing issue with RSA NetWitness 9.8.5.1 Hybrid build

Document created by RSA Customer Support Employee on Jan 10, 2017Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 2Show Document
  • View in full screen mode

Article Content

Article Number000016514
Applies ToRSA NetWitness NextGen
RSA NetWitness NextGen 9.8.5.1
RSA NetWitness Hybrid
IssuePartition and sizing issue with RSA NetWitness 9.8.5.1 Hybrid build
CauseThe Hybrid 9.8 ISO kickstart file designates 400GB for the filesysme named /dev/mapper/decoder-decosess and mounts /var/netwitness/sessionDB at this point.  The filesystem should be 40GB.  Some other mountpoints are also renamed.
Resolution

Run the  ?hybrid200.sh? script, which will rename and reconfigure the file system to the default sessionDB size.  This script file can be found and downloaded from the following RSA FTP site within the Server Update Supplemental folder: https://sftp.rsa.com/human.aspx?Username=v98&password=version98!&transaction=signon&quiet=true/

NOTE: You may need to perform a reconfig on the decoder service to correctly configure maximum DB sizes after running the hybrid200.sh script.  Refer to the knowledgebase article How to reconfigure and optimize RSA NetWitness NextGen 9.6.5.4 and above decoder and concentrator settings for additional information on this procedure.

Notes

Note and  verify the change:

   /var/netwitness /index  -----  change to /var/netwitness/decoder/index

  /var/netwitness/metadb   ----  change to /var/netwitness/decoder/metadb

  /dev/mapper/decoder-decosess     40G   33M      40G       1%        /var/netwitness/decoder/sessiondb

Legacy Article IDa60150

Attachments

    Outcomes