000036480 - RSA NetWitness Error Retrieving collection Types when opening LogCollector/Decoder configuration page

Document created by RSA Customer Support Employee on Jul 11, 2018
Version 1Show Document
  • Comment • 0
  • View in full screen mode

Article Content

Article Number000036480
Applies ToRSA Product Set: NetWitness Logs & Network
RSA Product/Service Type: NetWitness Admin server
RSA Version/Condition: 11.1.0.0
Platform: CentOS
 
IssueAfter upgrading from RSA NetWitness release "10.6.5" to version "11.1"  the configuration page of the Log Collector or Log Decoder is not loading up as depicted in the below snapshots: 

User-added image
User-added image

 
CauseStill to be determined as it could be misconfiguration with salt /chef db.
   

 
Resolution
  • Remove Log Decoder, Log Collector and Concentrator services from ADMIN-Services
  • Remove Log Hybrid Host from ADMIN-Hosts
  • Run following commands below through SSH session with "root" account on following nodes:
 

  1. From NW Host [e.g. LogHybrid]

  • Record the node ID you get out of running this command :

    cat /etc/salt/minion

  • Move the key to a temp directory:

    mv /etc/salt/minion /tmp

  • Restart the "salt-minion" service: 

    systemctl restart salt-minion


       2. From NW Admin
  • Delete the node ID recorded from step #1:

    salt-key -d <node ID>

    e.g. salt-key -d 74058888-b21b-4e9d-8018-be39b4439077

  • Verify that all node-related info have been removed:

    orchestration-cli-client --remove-key <node ID>

    e.g. orchestration-cli-client --remove-key 74058888-b21b-4e9d-8018-be39b4439077

      3. From NW Host [e.g. LogHybrid]

  • Run the RSA NetWitness bootstrap script:


nwsetup-tui


  • Select “Upgrade” option and select backup files from 10.6.5.
  • On the NetWitness UI [NWAdmin] go to "Hosts" page or refresh the page if you have it opened and the LogHybrid should appear automatically to be discovered, enabled and provisioned. 
  • Then select the install option and deploy select "LogHybrid" for the related services to be installed on the node. 
  • Now you should be able to open the configuration pages of both LogCollector & LogDecoder properly. 

Attachments

    Outcomes