Article Number
000001794
Applies To
RSA Product Set: NetWitness Logs & Network
RSA Version/Condition: 11.2.x, 11.2.1.1
Platform: CentOS
O/S Version: 7
Issue
Some customers observe an issue where after updating to 11.2.1, they can only view the Default dashboard. Their custom dashboards including the OOTB dashboards have disappeared and even though you create new dashboards, after logging out you are not able to access them via the Netwitness UI.
Cause
The issue points to some corrupted Dashlets which does contain null values for parameters such as "ipLimit"
Resolution
- Take a backup of the current Dashboards and Dashlet mongo collections from the Admin Server -
SSH to the Admin Server and run the below two commands;
Replace the {deploy_admin_password} with your current deploy_admin user password.
mongoexport --ssl --sslAllowInvalidHostnames -u deploy_admin -p {deploy_admin_password} --authenticationDatabase admin --db sa --collection dashboard --out /root/dashboard.json
mongoexport --ssl --sslAllowInvalidHostnames -u deploy_admin -p {deploy_admin_password} --authenticationDatabase admin --db sa --collection dashlet --out /root/dashlet.json
Note: If you do not know your current deploy_admin password, you should be able to obtain that by using the below command;
security-cli-client --get-config-prop --prop-hierarchy nw.security-client --prop-name platform.deployment.password --quiet
Two files will be saved in /root as dashboard.json & dashlet.json respectively.
- Check the dashlet.json file for any null parameters -
grep -E 'ipLimit|null' --color=always
For example, you may seen an entry such as the one below;
{"_id":{"$oid":"<DASHLET_OBJECT_ID>"},"_class":"com.rsa.smc.sa.common.dashboard.domain.model.Dashlet","dashboardId":"<DASHBOARD_ID>","dashletClass":"UAP.dashboard.dashlet.reporting.ReporterChartDashlet","column":1,"row":0,"options":{"unifiedDashboard":"true","ifInetType":"","dashboardLink":"NONE","refreshInterval":"15","title":"<TITLE>","dashletClass":"UAP.dashboard.dashlet.reporting.ReporterChartDashlet","pastHours":"72","chartId":"<CHART_ID>"chartName":"<CHART_NAME>","seriesType":"TIME_SERIES","chartType":"LINE","limit":"5","ipLimit":null},"linkedDashboards":[]}
In here the "ipLimit" parameter is set to null as highlighted. The value needs to be changed to an entry such as "10".
- Note the <DASHLET_OBJECT_ID> from the above command by analyzing the dashlet.json file and change the entry in the mongo database 'sa' and collection 'dashlet'
Login to the mongo database
# mongo admin -u deploy_admin -p {deploy_admin_password} --authenticationDatabase admin
> use sa
To check if the Dashlet object ID we have found is correct;
> db.dashlet.find({_id:ObjectId("<DASHLET_OBJECT_ID>")}).pretty()
Changing the "ipLimit":null to "ipLimit":"10"
> db.dashlet.updateOne({_id:ObjectId("<DASHLET_OBJECT_ID>"),"options.ipLimit":null},{$set:{"options.ipLimit":"10"}})
To verify the changes;
> db.dashlet.find({_id:ObjectId("<DASHLET_OBJECT_ID>")}).pretty()
> exit
- Restart the relevant services.
# systemctl restart mongod
# systemctl restart jetty
- After the jetty service restarts and the User Interface comes up, You may see the Custom and OOTB dashboards appearing again. However, you may also see many "Default Dashboard" entries.
To fix that, Select the Default Dashboard
Click on restore the default dashboard icon ( Image description ) to its original layout in the Netwitness UI
Logout from the Current user and Log back in.