|Applies To||RSA Product Set: NetWitness Logs & Network, Security Analytics|
RSA Product/Service Type: Log Collector
RSA Version/Condition: 10.6.4 and above
|Issue||Tried adding the destination in Virtual log collector through both config view and explore view. However, it failed with below error:-|
|Cause||The issue occurs after upgrading the system to 10.6.4 and above. Found that nw_admin-10.6.4.x.ez is missing under the directory #/opt/netwitness. Occurs due to the Symlink wasn't updated for the nw_admin plugin and was still pointing to older /opt/netwitness/nw_admin-10.6.x.x.ez|
|Resolution||Please open the SSH to log collector and execute below commands:-|
#ln -s /usr/lib/rabbitmq/lib/rabbitmq_server-3.5.7/plugins/nw_admin.ez /opt/netwitness/nw_admin-10.6.4.2.ez
Note: nw_admin-10.6.4.x.ez can be changed as per the version log collector is currently running on.
#service rabbitmq-server restart
This will remove the Symlink and create a new one from /usr/lib/rabbitmq/lib/rabbitmq_server-3.5.7/plugins/nw_admin.ez to /opt/netwitness/nw_admin-10.6.4.x.ez.