000026509 - How to use RSA NetWitness Crash Reporter v9

Document created by RSA Customer Support Employee on Jan 10, 2017Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 2Show Document
  • View in full screen mode

Article Content

Article Number000026509
Applies ToRSA NetWitness NextGen
RSA NetWitness NextGen 9.x
RSA NetWitness Decoder
RSA NetWitness Log Decoder
RSA NetWitness Concentrator
RSA NetWitness Hybrid
RSA NetWitness Broker
RSA NetWitness Crash Reporter
IssueHow to use RSA NetWitness Crash Reporter v9.
ResolutionIn the event that an RSA NetWitness appliance experiences a software problem Crash Reporter logs all system activity to a file which can be submitted to NetWitness support for root cause analysis.  Please use the following instructions to ensure Crash Reporter is running and to retrieve and submit Crash Reporter output to RSA Support.

1). Verify that Crash Reporter is running:

                From an SSH prompt type:

                initctl status nwcrashreporter

                You will see something similar to the below if the service is running:
                nwcrashreporter (start) running, process 1676

2). Start Crash Reporter if not running:

                From an SSH prompt type:

                start nwcrashreporter

                You will see the below when the crash reporter starts successfully:

                nwcrashreporter (start) waiting
                nwcrashreporter (start) starting
                nwcrashreporter (start) pre-start
                nwcrashreporter (start) spawned, process 2901
                nwcrashreporter (start) post-start, (main) process 2901
                nwcrashreporter (start) running, process 2901

4). In the event of a system crash the time stamped zip file will be located here:


               Example file name crashreport-2010-01-08_19-35-07.zip

5). Retrieve this file and attach it directly to your RSA Support case or send to nwsupport@rsa.com for root cause analysis.


If you are unsure of any of the steps above or experience any issues, contact RSA Support and quote this article ID for further assistance.

Legacy Article IDa58594