Skip navigation
All Places > Products > RSA NetWitness Platform > RSA NetWitness Platform Online Documentation > Documents
Log in to create and rate content, and to follow, bookmark, and share content with other members.

Sys Maintenance: Miscellaneous Tips

Document created by RSA Information Design and Development Employee on Sep 14, 2017Last modified by RSA Information Design and Development Employee on Sep 11, 2020
Version 34Show Document
  • View in full screen mode

Audit Log Messages

It can be useful to see which user actions result in which log message types in the /var/log/messages file.

The event categories spreadsheet included in the log parser package in the NetWitness Platform Parser archive lists the event categories and the event parser lines to help with building reports, alerts, and queries.

NwConsole for Health & Wellness

RSA has added the command option logParse in NwConsole. This command option supports log parsing, a convenient way to check a log parser without setting up the full system to perform log parsing. For more information about the logParse command, at the command line, type help logParse.

Thick Client Error: remote content device entry not found

The remote content device entry was not found error can be generated for a correlation rule applied to a Concentrator. In NetWitness Platform Investigate, if you click the correlation-rule-name meta value in the Alert meta key, you do not get session information.

Instead of using correlation rules on Decoders and Concentrators, use ESA rules. The ESA rules do record the correlation sessions that match the ESA rule.

View Example Parsers

Since Flex and Lua parsers are encrypted when they are delivered by Live, you cannot easily view their contents.

However, some plain text examples are available here:

Configure WinRM Event Sources

The following Inside Dell article has a video that walks through the process of setting up Windows RM (Remote Management) collection:

Additionally, it contains two scripts that are shortcuts for procedures described in the "Windows Event Source Configuration Guide."

Previous Topic:Error Notification
You are here
Table of Contents > Troubleshoot NetWitness Platform > Miscellaneous Tips