000036361 - How to optionally remove the use of SD Cards when migrating to RSA Netwitness 11.x from 10.x on Series 4S appliances

Document created by RSA Customer Support Employee on May 25, 2018Last modified by RSA Customer Support Employee on Feb 12, 2019
Version 55Show Document
  • View in full screen mode

Article Content

Article Number000036361
Applies ToRSA Product Set: NetWitness Logs and Packets
RSA Product/Service Type: Security Analytics Server
RSA Version/Condition: 10.6, 11.x
Issue* We are upgrading the NetWitness server from 10.6.x to 11.x. This is NOT a Series 4S hybrid.

* The system has SD Cards enabled in the BIOS and you would like to disable them. When we disable the SD cards in the BIOS the upgrade does not detect an eligible root file system and only allows to reinstall instead of upgrading.

* When we enable the SD cards in the BIOS the upgrade does detect an eligible root file system and then it allows the upgrade.

NOTE: The Series 4S Hybrids do not support this process. Leave the SD cards enabled and upgrade/migrate per the upgrade instructions.
Resolution Workaround

The workaround propose shows a way to upgrade without further use of the SD card. It includes procedures to disable the SD card and relocating the backup files onto a network share. This way we will able to proceed with the upgrade and have the NetWitness environment running without the use of SD card. 

    Backup script is on a CentOS 6 system that is NOT the NetWitness Server (in our case we used archiver)
    Backups will reside on CentOS 6 System that is NOT the NetWitness Server (in our case we used the archiver)

1. Make Backups using nwbackup script 4.0 with -u switch

2. Insert buildstick or iso using iDRAC

3. Reboot system

4. Press F10

5. Disable SD Cards in BIOS (For more detailed information on disabling SD Cards in BIOS check this article on buildsticking

6. Reboot

7. Press F11

8. Bios Boot manager

9. Boot from Buildstick/Virtual Media
User-added image

10. Press Enter to install 11.x

11. Type "y" to clear disk configuration
User-added image
User-added image

12. Reboot

13.Press F11

14. Bios Boot manager

15. Boot from Buildstick/Virtual Media

16. Press Enter to install 11.x

17. Type "n"

18. Type "R" to Reinstall
User-added image

19. Base OS Will install

20.System will Reboot Automatically
User-added image

21. Login as "root"

22. Password is "netwitness"
User-added image
User-added image

23. Start Configuring the network.

24. type "netconfig -p" -- this will show the network interfaces
User-added image

25. type netconfig --interface <interface from -p here> --static --ip <system ip here> --netmask <system net mask here> --gateway <network gateway here> --verbose
26. netconfig --interface eth0 --static --ip --netmask --gateway --verbose
User-added image

27. Create backup directories

mkdir /var/netwitness/database
mkdir /var/netwitness/database/nw-backup

User-added image

28. Copy backup files from the backup server

scp* /var/netwitness/database/nw-backup
scp /var/netwitness/database/nw-backup
scp* /var/netwitness/database/nw-backup

User-added image
User-added image
User-added image

29. Run Setup from iDRAC Console as it takes a long time, 1 hour or more in vm environment. Putty is dependent on a reliable network connection.


User-added image

30. Accept agreement
31. Yes - 11.1 NWServer
User-added image
32. Upgrade (From Previous Vers.)
User-added image
User-added image

33. Verify Backup Directory /var/netwitness/database/nw-backup
34. Create Master Password

35. Create Deploy Password

36. Select 1 - The Local Repo (on the NW Server)

37.  Apply Custom firewall Rules

38. Select 1 - Upgrade Now

39. Reboot host after install finishes

40. System will be successfully migrated
User-added image
User-added image
NotesThis process is an optional process for disabling SD cards on Series 4S appliances. It is not a requirement for upgrading Series 4S appliance from 10.6.x to 11.x. 

Do not use this process on Series 4S Hybrids. Hybrids keep NetWitness database data on the local server. Following this guide will cause data loss. If you have questions please contact RSA NetWitness Support.