Dashboards disappearing after updating to RSA NetWitness Logs & Network 11.2.1.1

[#1]

Article Number

000001794

Applies To

RSA Product Set: NetWitness Logs & Network
RSA Version/Condition: 11.2.x, 11.2.1.1
Platform: CentOS
O/S Version: 7

 

Issue

Some customers observe an issue where after updating to 11.2.1, they can only view the Default dashboard. Their custom dashboards including the OOTB dashboards have disappeared and even though you create new dashboards, after logging out you are not able to access them via the Netwitness UI. 

Cause

The issue points to some corrupted Dashlets which does contain null values for parameters such as "ipLimit" 

Resolution

1. Take a backup of the current Dashboards and Dashlet mongo collections from the Admin Server -
   SSH to the Admin Server and run the below two commands; 
   Replace the {deploy_admin_password} with your current deploy_admin user password.

   mongoexport --ssl --sslAllowInvalidHostnames -u deploy_admin -p {deploy_admin_password} --authenticationDatabase admin --db sa --collection dashboard --out /root/dashboard.json
   
   mongoexport --ssl --sslAllowInvalidHostnames -u deploy_admin -p {deploy_admin_password} --authenticationDatabase admin --db sa --collection dashlet --out /root/dashlet.json

   
   Note: If you do not know your current deploy_admin password, you should be able to obtain that by using the below command;

   security-cli-client --get-config-prop --prop-hierarchy nw.security-client --prop-name platform.deployment.password --quiet

   
   
   Two files will be saved in /root as dashboard.json & dashlet.json respectively.
    
2. Check the dashlet.json file for any null parameters -

   grep -E 'ipLimit|null' --color=always

   For example, you may seen an entry such as the one below; 

   {"_id":{"$oid":"<DASHLET_OBJECT_ID>"},"_class":"com.rsa.smc.sa.common.dashboard.domain.model.Dashlet","dashboardId":"<DASHBOARD_ID>","dashletClass":"UAP.dashboard.dashlet.reporting.ReporterChartDashlet","column":1,"row":0,"options":{"unifiedDashboard":"true","ifInetType":"","dashboardLink":"NONE","refreshInterval":"15","title":"<TITLE>","dashletClass":"UAP.dashboard.dashlet.reporting.ReporterChartDashlet","pastHours":"72","chartId":"<CHART_ID>"chartName":"<CHART_NAME>","seriesType":"TIME_SERIES","chartType":"LINE","limit":"5","ipLimit":null},"linkedDashboards":[]}

   
   In here the "ipLimit" parameter is set to null as highlighted. The value needs to be changed to an entry such as "10". 
    
3. Note the  <DASHLET_OBJECT_ID> from the above command by analyzing the dashlet.json file and change the entry in the mongo database 'sa' and collection 'dashlet'
   Login to the mongo database 

   # mongo admin -u deploy_admin -p {deploy_admin_password} --authenticationDatabase admin
   
   > use sa

   
   To check if the Dashlet object ID we have found is correct;
    

   > db.dashlet.find({_id:ObjectId("<DASHLET_OBJECT_ID>")}).pretty()

   
   Changing the "ipLimit":null to "ipLimit":"10"
    

   > db.dashlet.updateOne({_id:ObjectId("<DASHLET_OBJECT_ID>"),"options.ipLimit":null},{$set:{"options.ipLimit":"10"}})

   
   To verify the changes; 

   > db.dashlet.find({_id:ObjectId("<DASHLET_OBJECT_ID>")}).pretty()
   
   > exit

4. Restart the relevant services.
    

   # systemctl restart mongod
   
   # systemctl restart jetty

5. After the jetty service restarts and the User Interface comes up, You may see the Custom and OOTB dashboards appearing again. However, you may also see many "Default Dashboard" entries.
   To fix that, Select the Default Dashboard
   
   Click on restore the default dashboard icon (