Note: This article shows how to get into Single User mode, and not how to do any of the above.
Single user mode is also seen as maintenance or emergency mode.
Access the NetWitness appliance using the Console that is attached to the appliance, or over the configured iDRAC interface.
Reboot or power on the appliance.
After the BIOS and RAID controller checks, when the CentOS kernel boot starts to display the Grub Menu screen. Press the down arrow to pause on the Grub Menu screen. Image description
There should be one of more CentOS Linux kernel versions that can be selected. Select by selecting a CentOS Linux kernel version and enter "e" to edit the kernel boot parameters for that kernel version.
Enter the root login and password. Grub password is "NetWitness" (without quotation-marks). Image description
Edit the kernel boot parameters using either of the 2 below methods (where Method 1 seems easier).
Use the down arrow key to scroll through the lines of the kernel boot parameters. Image description
Look for the line that starts with "linux16", and with the cursor on this line press [End] to go to the end of the line. Change the parameter "rd.shell=0" at the end of the line to "rd.break". Image description
Press [Ctrl]-x to boot the kernel with this change, and it should boot to the switch_root prompt. Image description
Remount the /sysroot in "rw" mode, and set the mount /sysroot as the root (/) directory.
mount -o remount,rw /sysroot
Or Method 2:
Use the down arrow key to scroll through the lines of the kernel boot parameter. Look for the line that starts with "linux16", and with the cursor on this line, use the arrow keys to move on the line.
Change the parameter "ro" in the middle of the line to "rw init=/sysroot/bin/bash". Press [End] to go to the end of the line and remove the parameter "rd.shell=0" at the end of the line. Image description
Press [Ctrl]-x to boot the kernel with this change, and it should boot to the bash prompt. Image description
Set the mount /sysroot as the root (/) directory.
The NetWitness appliance is now in Single user/maintenance/emergency mode.
For more verbose output during the kernel boot also remove the parameters "rhgb quiet",
rhgb (redhat graphical boot) = This is a GUI mode booting screen with most of the information hidden whilst displaying a rotating activity icon spinning and shows only brief information as to what the computer is doing.
quiet = Hides the majority of the boot messages before rhgb starts.