Reporting: Troubleshooting

Document created by RSA Information Design and Development on Sep 14, 2017Last modified by RSA Information Design and Development on Sep 12, 2018
Version 12Show Document
  • View in full screen mode

This section provides troubleshooting instructions for issues faced when using the Reporting module in NetWitness Platform.

Configuring SFTP Server Issue

Procedure

Try the following steps if you face any issues while configuring the Linux SFTP server:

  1. If the Report Output Action for the configured SFTP fails, you must SSH to the SFTP server and try to connect locally to check if SFTP is working fine.

    Connect to SFTP server:

    Connect to SFTP server

  2. If the Local connection fails, open the file sshd_config> vi /etc/ssh/sshd_config.
  3. Check for the entry in the file:

    # override default of no subsystems
    Subsystem sftp /usr/libexec/openssh/sftp-server

  4. If this entry does not exist, add the two lines mentioned in Step 3 at the bottom of the file and Save it.
  5. Restart service from SSH > service sshd restart.
  6. Retry the SFTP connection now.
  7. Make sure SFTP port is not blocked by SA server appliance firewall. Update iptables rules to allow sftp port.

Meta Values in Investigation Link Issue

             
IssueWhen the device information on the datasource is changed, the Investigation link for the meta values of the executed reports is not displayed on the NWDB results page.
Resolution

Remove and re-add the datasource to Reporting Engine.

Note: This workaround is not applicable for reports that are already generated.

Internet Explorer 10 Browser Issue

             
IssueWhen you click the Test Rule multiple times in quick succession, results with large input data may not displayed in Internet Explorer 10.
Resolution

If this issue occurs, try one of the following steps:

  • Close the Test Rule window on Internet Explorer 10 and run the test again.
  • Use other browsers like Chrome or Mozilla Firefox to test the rule execution.

Dynamic List Editing Issue

             
IssueA dynamic list cannot be added from the Edit option on the 'View All Schedules' page to an existing schedule.
Resolution

1. Reports > Select the report >

2. Click the #Schedules for the specific report

3. Select the schedule to be modified from the Report Schedule page

4. Edit the schedule

Deployment Failure Issue

             
IssueDeployment of reports fail, if the dependencies of certain compliance reports in Live are not deployed prior to the reports.
Resolution

Retry the deployment. If the problem persists, try to deploy the rule or list dependencies first and then deploy the reports.

Respond Server Issue

             
IssueWhen the Forward Alerts to Respond option is enabled and RabbitMQ connections to the Respond Server are blocked, some of the Reporting Engine threads may be blocked.
Resolution

Disable the Forward Alerts to Respond option until the RabbitMQ broker in the NetWitness Platform server at the Respond has begun and accepts the connections.

Post-Upgrade Issue

             
IssuePost-upgrade from 10.6.x to 11.2, Categories meta for incident collection is not supported.
Resolution

When using the Categories meta for incident collection, the results rendered are in an incorrect format. Hence this meta is not supported and you cannot use the categories meta in either select clause or where clause. Also, it is not available in the list of metas for selection in the Rule Builder page.

Next Topic:Appendix
You are here
Table of Contents > Troubleshooting

Attachments

    Outcomes