restart decoder service through nwconsole api

[MichaelPochan]

Is there any documentation on the nwconsole API? We're attempting to script a way from our broker to restart the nwdecoder process on our packet decoders without maintaining ssh keys on each host. I've gone through the NwConsole options and don't see a way to restart any nw process, but might not be looking in the right place. Has anyone else had a similar issue or figured out a way to automate this? 

[JohnSnider]

NwConsole has built-in "man" and "help" pages, but for your request here are the options, of course these show the default username/password (admin/netwitness), so you'll need to put in whatever acct/password you are using:

Stop/Start Capture

• NwConsole -c login <ip of decoder>:56004:ssl admin netwitness -c /decoder stop flush=1
• NwConsole -c login <ip of decoder>:56004:ssl admin netwitness -c /decoder start

Restart Decoder Service (this is the same as the "shutdown service" on the "System View" page

• NwConsole -c login <ip of decoder>:56004:ssl admin netwitness -c /sys shutdown

if you use the non-ssl port (50004) omit the :ssl at the end of the login string.

[ChristopherAhea]

As long as it was configured to restart, you could pass the commands over REST or the NwConsole.

REST = 'http://192.168.99.51:50104/sys?msg=shutdown'

NwConsole = 'NwConsole -c login localhost:50004 admin netwitness -c /sys shutdown'

The -c option in NwConsole passes commands.

You could also issue a parser reload:

REST = 'http://192.168.99.51:50104/decoder/parsers?msg=reload'

NwConsole = 'NwConsole -c login localhost:50004 admin netwitness -c /parsers reload'

Stop/Start Capture

REST = 'http://192.168.99.58:50104/decoder?msg=stop'

REST = 'http://192.168.99.58:50104/decoder?msg=start'

NwConsole = 'NwConsole -c login localhost:50004 admin netwitness -c /decoder stop'

NwConsole = 'NwConsole -c login localhost:50004 admin netwitness -c /decoder start'

Hope this helps in getting what you need.

Chris

[MichaelPochan]

Thank you! We use REST to reload parsers, so I think the following command will work. 'Shutdown' however will start the process again once it's stopped? Does this affect both the nwappliance process and nwdecoder or just the nwdecoder process?

REST = 'http://192.168.99.51:50104/sys?msg=shutdown'

[ChristopherAhea]

Since that is hitting the decoder REST port (50104), it would just be the decoder service.

[JohnKisner]

Shutdown will automatically restart the service.