Failed to start capture: Failed to process message start for /decoder com.rsa.netwitness.carlos.transport.TransportExc eption: Decoder did not initialize correctly, please check the logs.
that would tend to point to not being able to open port 514, maybe another instance of the NwLogDecoder or NwDecoder running (ps -ef | grep Decoder) there should only be one, if it persists i'd reboot the appliance or check /var/log/messages for decoder socket errors and post some logs.
that would tend to point to not being able to open port 514, maybe another instance of the NwLogDecoder or NwDecoder running (ps -ef | grep Decoder) there should only be one, if it persists i'd reboot the appliance or check /var/log/messages for decoder socket errors and post some logs.