This topic describes the format and content of Log Collection Troubleshooting. NetWitness Platform informs you of Log Collector problems or potential problems in the following two ways.
- Log files.
- Health and Wellness Monitoring views.
Junk Syslog Messages
The remote log collector has been made looser in regards to how it handles syslog messages. This was done to reduce the number of dropped messages due to missing parts of the header, or for other minor formatting errors. However, this might also allow syslog event messages that contain junk to get through the parser. If you see such messages in the system, you can add a syslog collection filter to remove events that are sending these messages.
Log Files
If you have an issue with a particular event source collection protocol, you can review debug logs to investigate this issue. Each event source has a Debug parameter that you can enable (set parameter to On or Verbose) to capture these logs.
Caution: Only enable debugging if you have a problem with this event source and you need to investigate this problem. If you have Debug enabled all the time it will adversely affect the performance of the Log Collector.
Health and Wellness Monitoring
Health and Wellness monitoring makes you aware of potential hardware and software problems in a timely manner so that you can avoid to outages. RSA recommends that you monitor the Log Collector statistical fields to make sure that the service is operating efficiently and is not at or near the maximum values you have configured. You can monitor the following statistics (Stats) described in the Admin > Health & Wellness view.
Sample Troubleshooting Format
RSA NetWitness Platform returns the following types of error messages in the log files for.
| Log Messages | timestamp failure (LogCollection) Message-Broker Statistics:... timestamp failure (AMQPClientBaseLogCollection):... |
|---|---|
| Possible Cause | The Log Collector cannot reach the Message Broker because the Message Broker:
|
| Solutions |
prompt$ systemctl status rabbitmq-server rabbitmq start/running, process 10916
|
Log Collector DNS
Make sure that the log collector is configured as a DNS client for the corporate DNS server. Otherwise, the Log Collector will not know how to find the Kerberos Realm.
Check if DNS is configured, if not perform the following steps:
-
Add the DNS server addresses (“nameserver x.x.x.x” entries) in /etc/netwitness/platform/resolv.dnsmasq.
-
Restart the dnsmasq service using the following command:
systemctl restart dnsmasq
- Verify the capability to reach external systems via a hostname.
