I want to configure DAC with SA decoder and concentrator, so that all coming logs n packectes directly store on DAC rather than internal storage of appliances. What will be configuration, can anyone help?
Sent from Samsung Mobile
I want to configure DAC with SA decoder and concentrator, so that all coming logs n packectes directly store on DAC rather than internal storage of appliances. What will be configuration, can anyone help?
Sent from Samsung Mobile
search for nwinitarray.py in the KB.
Or you can create your own mapping using the rail and lvm.
Is this a hybrid? Or is it separate appliances? Have you licensed the devices yet? If it is separate appliances, you will need the nwinitarray.py script on each appliance, which must be run before licensing the devices. If its a hybrid, you will need to license the hybrid and then run nwmakearray.py script on the hyrid.
No, its a separate appliance not hybrid. I have high density direct attach capacity for decoder and high performance direct attach capacity for concentrator as a separate appliance. I have connected to decoder and concentrator but i dont know how to map with decoder and concentrator database so that all packets and meta key directly store in thier respective DAC rather than internal storage.
Or can you tell me from where i can get that script or where n how i have to run? Does license will matter?
Actually, I am new with storage i have never worked on storage.
Thanx
Sent from Samsung MobileAdam Rasnick <emc-community-network@emc.com> wrote:ECN
Can anyone help me in configuring DAC with decoder and concentrator
reply from Adam Rasnick in RSA Security Analytics - View the full discussion
Is this a hybrid? Or is it separate appliances? Have you licensed the devices yet? If it is separate appliances, you will need the nwinitarray.py script on each appliance, which must be run before licensing the devices. If its a hybrid, you will need to license the hybrid and then run nwmakearray.py script on the hyrid.
Reply to this message by replying to this email, or go to the message on ECN
Start a new discussion in RSA Security Analytics by email or at ECN
Following Can anyone help me in configuring DAC with decoder and concentrator in these streams: Inbox
So you have a DAC + decoder and a DAC + concentrator? Just clarifying because it matters how you set them up. And I can send you the scripts to run for this.
| Adam Rasnick | Practice Consultant, RSA Professional Services| 423.833.9297| adam.rasnick@emc.com | RSA The Security Division of EMC
can upload the script here? thanks.
I thought i uploaded the scripts...let me try it again and if you dont get the scripts let me know and i can email them.
| Adam Rasnick | Practice Consultant, RSA Professional Services| 423.833.9297| adam.rasnick@emc.com | RSA The Security Division of EMC
Thanks a lot. will test out. who maintain the script?
The scripts are maintained by RSA. Which devices are you using those for? They are specific depending on the appliances you are using.
| Adam Rasnick | Practice Consultant, RSA Professional Services| 423.833.9297| adam.rasnick@emc.com | RSA The Security Division of EMC
Hi Adam, I am also using RSA Devices for security analytics. Can you please share that script with me and please tell me how and where( I mean on Decoder/concentrator or DAC) I have to run so that log and packets directly goes to DAC instead of internal storage of Decoder and Concentrator.
Or if you have any document for DAC so that I can change their management IP address then Please share that also.
My Email id is rajveeryadav004@gmail.com
Thanx
Waiting for reply and help
The scripts are attached above in one of my replies. Are you able to see them?
Hi Adam thanx a lot for the scripts but still i am not getting that how i will run these scripts in decoder/concentrator.
Sent from Samsung MobileAdam Rasnick <emc-community-network@emc.com> wrote:ECN
Can anyone help me in configuring DAC with decoder and concentrator
reply from Adam Rasnick in RSA Security Analytics - View the full discussion
The scripts are attached above in one of my replies. Are you able to see them?
Reply to this message by replying to this email, or go to the message on ECN
Start a new discussion in RSA Security Analytics by email or at ECN
Following Can anyone help me in configuring DAC with decoder and concentrator in these streams: Inbox
You will need to run the scripts on each of the appliances (decoder/concentrator). Once you have set up the networking on the devices, you will be able to use WinSCP (download from the internet) to move the scripts to the decoder/concentrator.
Use "chmod +x nwinitarray.py"
then "./nwinitarray.py" to run the command, follow the directions from the command and you will be finished, its actually very simple once you start.
**Make sure you have not licensed the decoder or concentrator yet!!!**
Subject: Re: - Can anyone help me in configuring DAC with decoder and concentrator
ECN <https://community.emc.com/?et=watches.email.thread>
Can anyone help me in configuring DAC with decoder and conceontrator
reply from rajveer<https://community.emc.com/people/rajveer?et=watches.email.thread> in RSA Security Analytics - View the full discussion<https://community.emc.com/message/774896?et=watches.email.thread#774896>
Hi,
Is there any specific directory where i have to run these scripts in decoder/concentrator?
Or should run in root directory?
Sent from Samsung MobileAdam Rasnick <emc-community-network@emc.com> wrote:ECN
Can anyone help me in configuring DAC with decoder and concentrator
reply from Adam Rasnick in RSA Security Analytics - View the full discussion
You will need to run the scripts on each of the appliances (decoder/concentrator). Once you have set up the networking on the devices, you will be able to use WinSCP (download from the internet) to move the scripts to the decoder/concentrator.
Use "chmod +x nwinitarray.py"
then "./nwinitarray.py" to run the command, follow the directions from the command and you will be finished, its actually very simple once you start.
*Make sure you have not licensed the decoder or concentrator yet!!!*
Subject: Re: - Can anyone help me in configuring DAC with decoder and concentrator
ECN <https://community.emc.com/?et=watches.email.thread>
Can anyone help me in configuring DAC with decoder and conceontrator
reply from rajveer<https://community.emc.com/people/rajveer?et=watches.email.thread> in RSA Security Analytics - View the full discussion<https://community.emc.com/message/774896?et=watches.email.thread#774896>
Reply to this message by replying to this email, or go to the message on ECN
Start a new discussion in RSA Security Analytics by email or at ECN
Following Can anyone help me in configuring DAC with decoder and concentrator in these streams: Inbox
it doesn't matter.
additional: you can run nwraidutil.py to check the storage.
Hi patriot3w,
Can you please send me this script?
N also tell mi in which order i have to run these scipts because we have three scripts now,
1. Nwmkarry.py
2.Nwinitarry.py
3. Nwraidutil.py
Sent from Samsung Mobile
nwraidutil.py is already inside the appliance, you try to run or find.
The latest script need you to license the device first.
You need to run the correct one in the root directory.
| Adam Rasnick | Practice Consultant, RSA Professional Services| 423.833.9297| adam.rasnick@emc.com | RSA The Security Division of EMC
I have run that scripts which you have provided me earlier in your reply...
i just copied the scripts in to <root>
then run the command:
chmod +x nwinitarray.py
response was some type of encloser found and etc
after that i got my ssh session hang
aftr 5 min i started a new session
and run other scripts by
chmod +x nwmakearray.py
and it showing that deocder is not licensed first license your device and then try again by this scripts.
now tell what should i do?
Hi Adam,
I have tried to find a document regarding these scripts and DAC Configuration, but failed. i have also tried on doc.netwitness.com but its not there. if you have any document or any link regarding this then please kindly share.
waiting for reply n help
thanx
I have run that scripts which you have provided me earlier in your reply...
i just copied the scripts in to <root>
then run the command:
chmod +x nwinitarray.py
response was some type of encloser found and etc
after that i got my ssh session hang
aftr 5 min i started a new session
and run other scripts by
chmod +x nwmakearray.py
and it showing that deocder is not licensed first license your device and then try again by this scripts.
now tell what should i do?
You do not run both scripts on each box. are those hybrid appliances??
| Adam Rasnick | Practice Consultant, RSA Professional Services| 423.833.9297| adam.rasnick@emc.com | RSA The Security Division of EMC
No these are separate appliances.
I have
Packet concentrator
High performance DAC
packet Decoder
High Density DAC
Log decoder
High Density DAC
Log Concentrator
High performance DAC
High performance DAC is connected to Concentrator and i run these scripts on Concentrator
And to confirm the cabling, how have you cabled each appliance and DAC? did you just use one cable? or both cables?
| Adam Rasnick | Practice Consultant, RSA Professional Services| 423.833.9297| adam.rasnick@emc.com | RSA The Security Division of EMC
You only need to connect one cable...thats why the script freezes up.
If you connect both cables, the script freezes up.
| Adam Rasnick | Practice Consultant, RSA Professional Services| 423.833.9297| adam.rasnick@emc.com | RSA The Security Division of EMC
Okay, how should i connect that cable?
Mean which one i have to remove?
Or can i ask where we will use that other cable?
Sent from Samsung Mobile
The second cable is just a spare..or can be used in multiple DAC connections. You however, need to go from B on the DAC (which is the lower part of the DAC) into the "circle" ports on the appliance.
| Adam Rasnick | Practice Consultant, RSA Professional Services| 423.833.9297| adam.rasnick@emc.com | RSA The Security Division of EMC
What i got is?
I should use only one cable that would be left port on appliance decoder/ concentrator to left port on on DAC on lower part. From the pic which i have sent you earlier i have to remove right side connection, right????
Or in which order i have to run those scripts?
Sent from Samsung MobileAdam Rasnick <emc-community-network@emc.com> wrote:ECN
Can anyone help me in configuring DAC with decoder and concentrator
reply from Adam Rasnick in RSA Security Analytics - View the full discussion
The second cable is just a spare..or can be used in multiple DAC connections. You however, need to go from B on the DAC (which is the lower part of the DAC) into the "circle" ports on the appliance.
| Adam Rasnick | Practice Consultant, RSA Professional Services| 423.833.9297| adam.rasnick@emc.com | RSA The Security Division of EMC
Reply to this message by replying to this email, or go to the message on ECN
Start a new discussion in RSA Security Analytics by email or at ECN
Following Can anyone help me in configuring DAC with decoder and concentrator in these streams: Inbox
Following Adam Rasnick in these streams: Inbox
That is correct. You will not run both scripts, you will only run the nwinitarray.py before you license the devices.
| Adam Rasnick | Practice Consultant, RSA Professional Services| 423.833.9297| adam.rasnick@emc.com | RSA The Security Division of EMC
And nwmakearray.py i should run after licensed the device, right?
Adam you told me that both scripts would not run on each appliances, so can you please tell me, on which appliances i have to run both scripts or on which appliances i have to run only one scripts?
Sent from Samsung Mobile
Actually, I am new with dac mapping
Sent from Samsung Mobile
Hi Adam, 
I have connect DAC and SA appliance like this refer attached screen shot.
and i got successfully run script nwinitarray.py
and i got successfully mounted all the database of decoder and concentrator reffer screen shot.
and size of data base is now increased.
all the disk are online.
now can you please tell me that still i need to run scripts nwmakearray.py after license the device or its already done no need to run?
You are done, you do not need to run the nwmakearray script. Thats for a hybrid.
Y mean ?
So now its done, right?
Sent from Samsung Mobile
Yes, you are done. You only use the nwmakearray.py on hybrid devices after they are licensed.
| Adam Rasnick | Practice Consultant, RSA Professional Services| 423.833.9297| adam.rasnick@emc.com | RSA The Security Division of EMC
Hi adam/pariot3w Thanx for the great support.
N plz also try to help in that jetty error case
Sent from Samsung Mobile
glad your issue has been resolved.
hi patriot3w/Adam
i have just check through GUI select device>stats
and i got that Decoder have all drive unchecked while concentrator has all device checked, have a look on attached screen shot.
Hi Adam/Patriot
after restarting device i am getting problem in decoder they not going up showing problem like this and stucked here
is the cable or disks connected?
Yes, everything i connected, even it shoe online in bios except virtual disk. Virtual disk state is optimal
Dont know what to do?
Sent from Samsung Mobilepatriot3w <emc-community-network@emc.com> wrote:ECN
Can anyone help me in configuring DAC with decoder and concentrator
reply from patriot3w in RSA Security Analytics - View the full discussion
is the cable or disks connected?
Reply to this message by replying to this email, or go to the message on ECN
Start a new discussion in RSA Security Analytics by email or at ECN
Following Can anyone help me in configuring DAC with decoder and concentrator in these streams: Inbox
i'm not sure, are you able to open a support case with RSA support?
What i encountered before was the virtual disks were removed after ran the script or removed manually, that caused not able to boot up.
So now what can I do to resolve this issue, but I have not removed any virtual disk. And I have also mapped DAC with packet decoder and that is working properly.
refer to this:
The message indicates that some configured disks were removed. If the disks were not removed, they are no longer accessible. The SAS cables for your system might be improperly connected. Check the cable connections and fix any problems. Restart the system. If there are no cable problems, press any key or <C> to continue.
http://support.dell.com/support/topics/global.aspx/support/kcs/document?docid=578292&DoNotRedirect=y
Where should I check the SAS cable connection?
But I restart the system and still getting same problem. I have checked in bios it showing that virtual drive is in optimal state, how can I make them in ready state. Refer attachéd document what problem I am having
Hi Adam/patriot,
Can you tell me is this problem can be resolved by reinstalling Log decoder appliance or if yes, then where I will get ISO and installation documents?
Or any other way to resolve this?
Did you restart your decoder after initializing the DAC?
| Adam Rasnick | Practice Consultant, RSA Professional Services| 423.833.9297| adam.rasnick@emc.com | RSA The Security Division of EMC
yes i have restart the decoder but have not restart the storage. i just checked that volgruop01 is missing, its showing volgroup00 and volgroup02
HI adam,patriot3W
can you please tell me how to update SA analytics server?
actually i Have a SA server which admin user is not working showing bad credential, support tell me that update it your SA will update and admin problem will also resolve.
he told me first extract that script which present with SA server upgrade package, according to upgrade Guide that script is for the sa that is below then 10.2, My SA server is 10.2
well i have both upgrdae package and scripts, now how can i upgrade SA server through ssh because admin user is not accepting password.
i have tried to run that scripts and package rpm package by using rpm -Fvh *rpm but its showing maleware dependency, have a look on attached text file
Hi Rajveer, i also encounter the same issue. However im using yum to do the upgrade.
In your case, you can install malwaredeps-yara first: rpm -ivh malwaredeps-yara-1.7-1.el6.x86_64.rpm
rpm -ivh /root/10.3deps/malwaredeps-yara-1.7-1.el6.x86_64.rpm
then you try again
Are you trying to go to 10.3?
| Adam Rasnick | Practice Consultant, RSA Professional Services| 423.833.9297| adam.rasnick@emc.com | RSA The Security Division of EMC
ya, i did it thanks asking for help
Hi Adam/patriot
As you know that i have an issue during log decoder startup, its showing that some kind of database does not exist. please refer the attached screen shot.
when i type root password then its let me do enter in maintenance mode.
can you please have look on this issue and help me to resolve this. as my understanding its checking some file in DAC during startup and tell that it does not exit.
is this problem have any solution
or re-installation is only option?
waiting for your response
This is a problem I have not dealt with. I would def contact customer support!
| Adam Rasnick | Practice Consultant, RSA Professional Services| 423.833.9297| adam.rasnick@emc.com | RSA The Security Division of EMC
Hi adam can you pkease tell me the default username and password fir RSA SA appliances. I tried with
username: root
Password: calvin
But its showing wrong creditential. I have to configure managment Ip address for appliances.
Plz help in this case also
Sent from Samsung MobileAdam Rasnick <emc-community-network@emc.com> wrote:ECN
Can anyone help me in configuring DAC with decoder and concentrator
reply from Adam Rasnick in RSA Security Analytics - View the full discussion
The scripts are attached above in one of my replies. Are you able to see them?
Reply to this message by replying to this email, or go to the message on ECN
Start a new discussion in RSA Security Analytics by email or at ECN
Following Can anyone help me in configuring DAC with decoder and concentrator in these streams: Inbox
Root/Netwitness
| Adam Rasnick | Practice Consultant, RSA Professional Services| 423.833.9297| adam.rasnick@emc.com | RSA The Security Division of EMC
it's small letter: root/netwitness to access the SSH or login
For REST, it's admin/netwitness
Hi Adam,Patriot3w
I am not asking for ssh or rest username or password.
I am asking for SA Dell appliances iDrac username and password.
I mean username and password so that i can manage appliances.
Before dell used root as username and calvin as password. But now in SA appliances its showing wrong credential.
Sent from Samsung Mobilepatriot3w <emc-community-network@emc.com> wrote:ECN
Can anyone help me in configuring DAC with decoder and concentrator
reply from patriot3w in RSA Security Analytics - View the full discussion
it's small letter: root/netwitness to access the SSH or login
For REST, it's admin/netwitness
Reply to this message by replying to this email, or go to the message on ECN
Start a new discussion in RSA Security Analytics by email or at ECN
Following Can anyone help me in configuring DAC with decoder and concentrator in these streams: Inbox
idrac is root/themaster01
| Adam Rasnick | Practice Consultant, RSA Professional Services| 423.833.9297| adam.rasnick@emc.com | RSA The Security Division of EMC
Hi Adam,
Thank you so much, its working. root and themaster01 is correct.
Hi Adam,
I have run that scripts nwinitarray.py and it run but aftr that session was hang. when i run the command df -h its not showing any extendation in DB.
and when i run other scripts nwmakearray.py
its saying decoder service is unlicensed try next time
attaching screen shot, Guide me its done or still have to do anything ?
OK...first off.
Please list the devices that you have...you can not just run these scripts on any device because they are meant for specific devices and have to be run in a certain order...please reply with the list of devices and i will tell you which file and in which order to run things...
| Adam Rasnick | Practice Consultant, RSA Professional Services| 423.833.9297| adam.rasnick@emc.com | RSA The Security Division of EMC
Hi,
Did anybody find the document " Direct-Attached Capacity (DAC) Series 4 Setup Guide." ???
'SA Decoder Hardware Description' document ask to refer to this document but I can't find it.
I did the connection and configuration with help from PS but can't understand why there's only one SAS cable from Hybrid to DAC (except the nwmakearray.py can't success). EMC DAC is supplied with two boards probably for redundancy (I previoulsy experimented a faulty board on enVision DAS-2000 and redundancy was OK).
Can somebody supply the 'official' document and clarify the redundancy point.
Thanks
we are facing this redundancy question 'regards DAC' so many time and still RSA support not able to give answer on this point, can you please guide us on this.
as you know DAC have 2 controller, lower one we have used for DAC initialzation and DAC extendation but still upper controller is free obviously RSA has provide this for redundancy, but how we have to connect, does anybody know about this?
DACs use the same Disk shelves used in the EMC VNX SANs. In a VNX SAN, there are 2 controller channels (A & B) so one interface card on the DAC goes connects to the A Channel and one goes to the B channel, all the redundancy is within the VNX controller, NOT the SAS interfaces modules on the back of the DAC, they have no real intelligence of their own.
So if you need redundancy you need VNX.
Thx for your answer....
In my mind, if you can release the 'Direct-Attached Capacity (DAC) Series 4 Setup Guide.' there will be less request to RSA Support.
Sebastien
maybe you can search for KB a58842.
a58842ExtStrgEncInstPrc96aboveNxtGenApp.pdf
For redundancy, i'm not sure, only think i know is to connect multiple DACs without any redundancy. Since it's already RAID5
Hello, Everyone,
Just my 2 cents. I set up a log hybrid with a 32Tb capacity DAC using Adam's script (nwmakearray.py - thanks a lot!). Everything went smooth. Didn't have time to wait for support so I used these scripts - can reimage if something goes wrong.
But back to the point - support sent me completely different scripts and without docs , they are in the attachment, if anybody will need them. Didn't test them though.
yes, the new script can support new device type like archiver.
Adam Rasnick<img alt="1.jpg" class="jive-image" src="/servlet/JiveServlet/downloadImage/73422/1.jpg" style="width: 620px; height: 349px;"/><img alt="2.jpg" class="jive-image" src="/servlet/JiveServlet/downloadImage/73423/2.jpg" style="width: 620px; height: 349px;"/><img alt="3.jpg" class="jive-image" src="/servlet/JiveServlet/downloadImage/73424/3.jpg" style="width: 620px; height: 349px;"/><img alt="4.jpg" class="jive-image" src="/servlet/JiveServlet/downloadImage/73440/4.jpg" style="width: 620px; height: 349px;"/><img alt="5.jpg" class="jive-image" src="/servlet/JiveServlet/downloadImage/73441/5.jpg" style="width: 620px; height: 349px;"/>Adam Rasnick
Is this a hybrid? Or is it separate appliances? Have you licensed the devices yet? If it is separate appliances, you will need the nwinitarray.py script on each appliance, which must be run before licensing the devices. If its a hybrid, you will need to license the hybrid and then run nwmakearray.py script on the hyrid.