Recurring Feed Issue
Has anyone encountered this particular issue? We're retrieving .csv files of indicators for our packet decoders and storing them in our broker in /var/netwitness/srv/www/feeds/. Prior to upgrading to 10.6.2.0, this process worked fine.
From there, we are trying to pull that file from the custom feed wizard in the GUI, the verification check always fails:
The file is definitely there. Even if I try to curl the file locally from the broker, I get a 404. Attempting to retrieve any other file fails verification checks (I used http and https). Should we be using another port? This was all functional prior to the upgrade.
- Community Thread
- Custom Feed
- Forum Thread
- RSA NetWitness
- RSA NetWitness Platform
You should get rid of the var/netwitness/srv/www. That is the root of the web server. Try just http://HOST/feeds/your.csv
Naushad A Kasu | Senior Practice Consultant, Professional Services | RSA | m: 612.772.5843<tel:612.772.5843> | e: firstname.lastname@example.org<mailto:email@example.com> | www.rsa.com<http://www.rsa.com/>
I'm having the same problem, but your advice did not help.
I put the .csv file in rsa-host/feeds and in Live->Feeds enter the url - http://rsa-host/feeds/[...].csv
Result - "Failed to access file".
What else could be the problem?
running 10.6.4.0 and this works for me
[root@sa6 www]# pwd
i see you have created a subdirectory for your feeds, try changing the hostname to localhost instead of the name and see if that helps.
try moving the feed out of the feeds directory and test your your url to see if there is an issue being in that nested directory (permissions or some other issue maybe)
I have already tried it too.
The .csv file was also in the created directory /feeds, and in the directory ./, and in the directory /home/[user] (both with and without "Authenticated").
The result is anyway - "Failed to access file".