|Applies To||RSA Product Set: NetWitness Logs & Network|
RSA Product/Service Type: NetWitness Admin server
RSA Version/Condition: 22.214.171.124
|Issue||After upgrading from RSA NetWitness release "10.6.5" to version "11.1" the configuration page of the Log Collector or Log Decoder is not loading up as depicted in the below snapshots: |
|Cause||Still to be determined as it could be misconfiguration with salt /chef db.|
- Remove Log Decoder, Log Collector and Concentrator services from ADMIN-Services
- Remove Log Hybrid Host from ADMIN-Hosts
- Run following commands below through SSH session with "root" account on following nodes:
- From NW Host [e.g. LogHybrid]
2. From NW Admin
3. From NW Host [e.g. LogHybrid]
- Delete the node ID recorded from step #1:
salt-key -d <node ID>
e.g. salt-key -d 74058888-b21b-4e9d-8018-be39b4439077
- Verify that all node-related info have been removed:
orchestration-cli-client --remove-key <node ID>
e.g. orchestration-cli-client --remove-key 74058888-b21b-4e9d-8018-be39b4439077
- Run the RSA NetWitness bootstrap script:
- Select “Upgrade” option and select backup files from 10.6.5.
- On the NetWitness UI [NWAdmin] go to "Hosts" page or refresh the page if you have it opened and the LogHybrid should appear automatically to be discovered, enabled and provisioned.
- Then select the install option and deploy select "LogHybrid" for the related services to be installed on the node.
- Now you should be able to open the configuration pages of both LogCollector & LogDecoder properly.