In the NetWitness UI, Admin > Health & Wellness, Alarms tab
There is an alarm for LogCollector Event Processor Exchange Bindings Status with a Value of "Unbounded Exchanges: netflow, windowslegacy" which will not clear.
This NetWitness UI, Health & Wellness alarm indicates that the VLC rabbitmq-server has exchanges netflow and windowslegacy created but no bindings were found to a matching queue.
Possible cause could be, but not limited to, the VLC being mistakenly tagged as a Local Collector (LC) instead of a Remote Collector (RC), or the rabbitmq queue was removed but the exchange didn't get removed.
To clear this alarm, you need to delete the netflow and windowslegacy exchanges from the VLC rabbitmq-server.
One method is to access VLC rabbitmq-server web interface to delete an existing exchange.
If you are unable to access the VLC rabbitmq-server web interface, this article provides a method to run the command directly on the VLC to delete the exchange without requiring access to the rabbitmq-server web interface.
Perform below steps to delete the netflow and windowslegacy exchanges from the VLC using the rabbitmqadmin.py script.
Connect to the VLC via SSH and navigate to the directory, /opt/netwitness/bin
[root@VLC ~]# cd /opt/netwitness/bin
Verify that the netflow and windowslegacy exchanges exist on the VLC using the rabbitmqadmin.py script.