This website uses cookies. By clicking Accept, you consent to the use of cookies. Click Here to learn more about how we use cookies.
Accept
Reject

NetWitness Community

  • Home
  • Products
    • NetWitness Platform
      • Advisories
      • Documentation
        • Platform Documentation
        • Known Issues
        • Security Fixes
        • Hardware Documentation
        • Threat Content
        • Unified Data Model
        • Videos
      • Downloads
      • Integrations
      • Knowledge Base
    • NetWitness Cloud SIEM
      • Advisories
      • Documentation
      • Knowledge Base
    • NetWitness Detect AI
      • Advisories
      • Documentation
      • Knowledge Base
    • NetWitness Investigator
    • NetWitness Orchestrator
      • Advisories
      • Documentation
      • Knowledge Base
      • Legacy NetWitness Orchestrator
        • Advisories
        • Documentation
  • Community
    • Blog
    • Discussions
    • Events
    • Idea Exchange
  • Support
    • Case Portal
      • Create New Case
      • View My Cases
      • View My Team's Cases
    • Community Support
      • Getting Started
      • News & Announcements
      • Community Support Forum
      • Community Support Articles
    • Product Life Cycle
    • Support Information
    • General Security Advisories
  • Training
    • Blog
    • Certification Program
    • Course Catalog
    • New Product Readiness
    • On-Demand Subscriptions
    • Student Resources
    • Upcoming Events
  • Technology Partners
  • Trust Center
Sign InRegister Now
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
NetWitness Discussions
Announcement Banner

Users are unable to open Netwitness Support Cases via email. Please open support cases via portal or by phone

View Details
  • NetWitness Community
  • Discussions
  • Synching Files across Your Deployment
  • Options
    • Subscribe to RSS Feed
    • Mark Topic as New
    • Mark Topic as Read
    • Float this Topic for Current User
    • Bookmark
    • Subscribe
    • Mute
    • Printer Friendly Page

Synching Files across Your Deployment

DavidWaugh1
Employee DavidWaugh1
Employee
Options
  • Mark as New
  • Bookmark
  • Subscribe
  • Mute
  • Subscribe to RSS Feed
  • Permalink
  • Print
  • Email to a Friend
  • Report Inappropriate Content

‎2016-05-24 05:47 AM

For convenience it is useful that you might want to sync files automatically across your deployment.

 

For example, you may wish to ensure that all parsers on your logdecoders are the same, and all table-map-custom.xml entries are consistent across your Security Analytics estate.

 

To solve this, I designate one of my Log Decoders as the master system, and then have the following cron job configured:

 

The cron job is called /etc/cron.hourly/rsync.sh

 

rsync -av /etc/netwitness/ng/envision/ root@192.168.123.44:/etc/netwitness/ng/envision

rsync -av /etc/netwitness/ng/parsers/ root@192.168.123.44:/etc/netwitness/ng/parsers

ssh root@192.168.123.44 '/etc/cron.hourly/parsers-reload.sh'

 

This file makes sure that the /etc/netwitness/ng/parsers directory and the /etc/netwitness/ng/envision directories are the same between the system where the cronjob is running and my second log decoder at 192.168.123.44

 

I have set up public key SSH access between the log decoders.

 

Note the parsers-reload script is just a script that I use just to reload the parsers once they have changed:

 

more /etc/cron.hourly/parsers-reload.sh

#Reload Device Table Map

NwConsole -c "login localhost:50002 admin netwitness" -c "/decoder/parsers ipdevice op=edit entries=\"+192.168.111.111=rhlinux\"

reload=true"

#Reload Parsers

NwConsole -c login localhost:50002 admin netwitness -c parsers reload

#Reload Feeds

NwConsole -c "login localhost:50002 admin netwitness" -c "/decoder/parsers feed op=notify" -c "logout"

  • Community Thread
  • Discussion
  • Forum Thread
  • logdecoder
  • Lua
  • NetWitness
  • NW
  • NWP
  • Parser
  • RSA NetWitness
  • RSA NetWitness Platform
  • sync
0 Likes
Share
Reply
  • All forum topics
  • Previous Topic
  • Next Topic
0 REPLIES 0
Powered by Khoros
  • Blog
  • Events
  • Discussions
  • Idea Exchange
  • Knowledge Base
  • Case Portal
  • Community Support
  • Product Life Cycle
  • Support Information
  • About the Community
  • Terms & Conditions
  • Privacy Statement
  • Acceptable Use Policy
  • Employee Login
© 2022 RSA Security LLC or its affiliates. All rights reserved.