Duplicate services on SA server after backup

[YossiNagar]

Hi, 

We built an automated task to perform weekly backup for our security analytics components. As part of the backup process it's required to restart the jettysrv, after the jetty is restarted and the GUI is available - a duplicate services are created. 

The problem is that there are two instances (I believe I can name it that way) of Reporting Engine service that prevent the system from opening the Reports tab and from running reports. We solve the problem by removing the duplicated instance from the UI, probably there is a collision between these two instances..  

Can anyone guess why it's occurring and how can I solve it without logging in the system after every backup process?

Maybe there is an option to identify the duplicated instance and to remove it from the CLI..? (then i'll some bash script)

Thanks, 

Yossi. 

[JohnSnider]

The issue is that you have the SA server configured with it's actual IP address, along with the default 127.0.0.1, you need to remove the actual IP address entries permanently.  When Jetty restarts, it's doing a device discovery and finds the actual IP entry and creates ALL services for that IP address along with the default 127.0.0.1.  You cannot have both, and should not have the actual IP entries for the SA server.

Beyond that, the official backup scripts for NetWitness 10.x do NOT require stopping of services (or restarting of services) for the backup to complete successfully.