If the Incident Manager isn't set up properly, then the IM Database may automatically generate incidents on the Netwitness UI Server, which is not a supported configuration. When this happens, it is necessary to move the database from the Netwitness UI Server to the ESA Server. When the IM Database is moved from the UI, it is also necessary to move the 'incident increment.' Otherwise, the numbers for the Incident IDs will start overwriting the previous incident ID's (i.e, INC-1...INC4). The steps to move the database can be found in the following article: https://community.rsa.com/docs/DOC-45376 .
Case Scenario We have moved the Mongo IM Database from the Netwitness UI Server to the ESA server. The Incident ID's are starting from (INC-1...INC-4) when there are already incidents created using that ID. The next Incident ID should be 71. What is needed to fix this issue?
Change the IM Database number to the current Incident ID in IM Database that was just moved to the ESA Server.
If you move the IM Database to the ESA server you will need to provide credentials as shown below. (You don't need to do this if you are on the Netwitness UI Server)
mongo im -u im -p im
To view all of the collections execute the following command:
Next, look at the collections...there should be one database titled, "db.tracking_id_sequence." Use the 'find' parameter below to show the contents of the collection:
This output may be displayed from the previous command...db.tracking_id_sequence.find(). The value '1' is shown in the following entry as an example (your results may differ).