A DAC is essentially an external logical disk. Before you power it off, you need to make sure all filesystems have been unmounted properly to avoid data corruption. The easiest way to do this is to first power off the Decoder or Concentrator connected to it. After this is cmoplete, it is safe to power off the DAC.
Stopping capture and aggregation, waiting for the buffers to clear and then stopping the NetWitness services is a key part of gracefully closing the databases on RSA NetWitness appliances.
There is a great deal of disk i/o going on so shutting down gracefully is really important to make sure the databases and file systems are in a quiescent state before powering off the systems and any attached external capacity.
A draft document with detailed procedures for shutting down and restarting RSA NetWitness appliances with and without attached DACs and JBODs is in process. I will post an update when the document is published.
Does anyone know why all appliances don't shutdown cleanly if you just shutdown from the Unix prompt? They seem to get stuck if you don't stop the NW services first.
Can you identify which appliances you are having trouble with, including the version of Linux and NextGen, that are not shutting down properly when using the "shutdown -h now" command.
Primus article a60102, "Shutting Down and Restarting RSA NetWitness NextGen Appliances," was published earlier this month (Feb. 2013) providing detailed steps on shutting down RSA NetWitness appliances with and without attached DACS.
Hello, I am finding it difficult to reach this document. can you please help me with exact link to download this ?
on Sep 18, 2012
It is worth pointing out that to shut down the Concentrator or Decoder you have to manually halt the NetWitness services first, otherwise they won't shut down cleanly. On Centos based systems monit stop nwdecoder or monit stop nwconcentrator should work. After that you can just shutdown -h
Does anyone know why all appliances don't shutdown cleanly if you just shutdown from the Unix prompt? They seem to get stuck if you don't stop the NW services first.