NetWitness Community

Bhavani_Kari · ‎2024-10-26

Hi NetWitness Community,

We upgraded the version from 12.4.1.0 to 12.5.0.0. After the upgrade, we received a new home page with many custom widgets. However, when I try to configure anything, it doesn't work and displays an error :

Respond Server offline

The Respond Server is not running or is inaccessible. For more details contact your administrator.

(Error Code: 1302)

Any one have the idea please help me.

Arasnick · ‎2024-10-28

Following, we have the same issue.

JohnKisner · ‎2024-10-28

@Bhavani_Kari do you have an Event Stream Analysis (ESA) server within your environment? The respond server uses the mongo database that is on the ESA server. If you do have one, please double check the Respond configuration that it is pointing to the primary ESA server. If you don't have one, this could be a possible bug. In either case you may want to look at opening a NetWitness Support case.

joohyoung · ‎2024-10-31

Does the Default ID (admin) account have the same phenomenon? Or does it only happen in accounts other than the admin account?

Arasnick · ‎2024-11-01

It is happening with the admin account as well. Here is a screenshot of what our screens look like, and the respond server is up and healthy.

JohnKisner · ‎2024-11-01

@Arasnick The ESA is what you need to make sure is up and running and that the Respond server is correctly connecting to it so it can use the mongo database on that server. Can you provide the Respond Server log /var/log/netwitness/respond-server?

Arasnick · ‎2024-11-01

Hey Jay, good to hear from you again! Here is a copy of our respond-server log.

JohnKisner · ‎2024-11-01

@Arasnick hope you are doing well 🙂

Looking over the respond log I think it may not be correctly configured. I see a lot of warnings and errors. Have you reviewed the Respond Server Configuration guide: https://community.netwitness.com/t5/netwitness-platform-online/respond-configuration-guide-for-12-4-1/ta-p/714073

The way these errors are showing it looks to me like it can't see the mongo database on the Primary ESA server. Take a look at the above guide if you haven't seen it before. There isn't a mention of the connection mechanism between the Respond and ESA though but it helps to setup some of the reporting sources. See if you can get any of them to setup. We use to have to manually tell the respond server the IP address of the ESA. It seems now that the system should be able to figure it out on its own as I can't find any configuration information specifically for telling the Respond server about the ESA. However, there may be something in the guide that will kick start things.

2024-10-22 07:49:58,524 [ https-jsse-nio-7003-exec-8] WARN o.s.w.s.PageNotFound|No mapping for GET /
2024-10-22 08:00:36,852 [ https-jsse-nio-7003-exec-5] WARN o.s.w.s.PageNotFound|No mapping for GET /
2024-10-22 08:00:36,872 [ https-jsse-nio-7003-exec-10] WARN o.s.w.s.PageNotFound|No mapping for GET /premise/login
2024-10-22 08:01:20,243 [ https-jsse-nio-7003-exec-5] WARN o.s.w.s.PageNotFound|No mapping for GET /
2024-10-22 08:01:20,258 [ https-jsse-nio-7003-exec-10] WARN o.s.w.s.PageNotFound|No mapping for GET /webtools/control/main
2024-10-22 08:02:01,572 [ https-jsse-nio-7003-exec-5] WARN o.s.w.s.PageNotFound|No mapping for GET /
2024-10-22 08:02:01,588 [ https-jsse-nio-7003-exec-10] WARN o.s.w.s.PageNotFound|No mapping for GET /i18n/adminconsole_en_us.json
2024-10-22 08:02:18,538 [ https-jsse-nio-7003-exec-10] WARN o.s.w.s.PageNotFound|No mapping for GET /
2024-10-22 08:02:18,552 [ https-jsse-nio-7003-exec-5] WARN o.s.w.s.PageNotFound|No mapping for GET /phoenix/js/login.min.js
2024-10-22 08:02:18,756 [ https-jsse-nio-7003-exec-10] WARN o.s.w.s.PageNotFound|No mapping for GET /
2024-10-22 08:02:18,771 [ https-jsse-nio-7003-exec-5] WARN o.s.w.s.PageNotFound|No mapping for GET /signin
2024-10-22 08:02:19,284 [ https-jsse-nio-7003-exec-4] WARN o.s.w.s.PageNotFound|No mapping for GET /
2024-10-22 08:02:19,298 [ https-jsse-nio-7003-exec-9] WARN o.s.w.s.PageNotFound|No mapping for GET /fsum/login
2024-10-22 08:02:19,893 [ https-jsse-nio-7003-exec-2] WARN o.s.w.s.PageNotFound|No mapping for GET /
2024-10-22 08:02:27,271 [ https-jsse-nio-7003-exec-5] WARN o.s.w.s.PageNotFound|No mapping for GET /
2024-10-22 08:02:27,285 [ https-jsse-nio-7003-exec-10] WARN o.s.w.s.PageNotFound|No mapping for GET /+CSCOT+/translation-table
2024-10-22 08:02:27,299 [ https-jsse-nio-7003-exec-5] WARN o.s.w.s.PageNotFound|No mapping for GET /+CSCOT+/oem-customization
2024-10-22 08:02:27,314 [ https-jsse-nio-7003-exec-10] WARN o.s.w.s.PageNotFound|No mapping for GET /+CSCOT+/translation-table

If not, a support ticket may be required as my ESA/Respond knowledge is a little limited.

Arasnick · ‎2024-11-01

Yeah, same here ha! Looks like I will need to open a case. I even walked through and set up a new ESA deployment and have it functioning, checked the reporting engine for its forwarding of events and neither of those gave me any issues. There must be something I am missing.

JohnKisner · ‎2024-11-01

@Arasnick Sounds good. Based on what I'm seeing I suspect it is going to need a little more hands on assistance from Support to take care of this issue.