Default context menus are not displayed or missing in RSA NetWitness Platform Investigations

[#1]

Article Number

000029530

Applies To

RSA Product Set: NetWitness Logs & Network
RSA Product/Service Type: NetWitness UI, NetWitness Server
RSA Version/Condition: 10.6.x, 11.x
Platform: CentOS
 

Issue

Context Menus may seem to disappear entirely from the NW UI under Administration > System > Context Menu Actions. This can also happen when Context Menu files get corrupted if they are copied from Windows to Linux due to Carriage Return characters being inserted at the end of each line in the files.
The error message "Error Loading Plugins" can be seen in the /var/lib/netwitness/uax/logs/sa.log file in these circumstances.

Resolution

To resolve the issue, follow the steps below:

1. Connect to the NetWitness server via SSH as the root user.
2. Backup and move all context files from the locations below. At the end of this step, these folders should be empty:
   • /var/lib/netwitness/uax/plugins/context-actions/events
   • /var/lib/netwitness/uax/plugins/context-actions/investigation
   • /var/lib/netwitness/uax/plugins/context-actions/live
3. Next, back up the /var/lib/netwitness/uax/conf/contextMenuConfiguration.cfg file.
4. Stop the jettysrv service with the following command:  stop jettysrv  (For 11.x, systemctl stop jetty.service)
5. Restart the jettysrv service with the following command:  start jettysrv (For 11.x, systemctl start jetty.service)

After the jetty webserver has fully initialized, you should now see all default context menu config files regenerated under above directories and that the plugins are all loaded successfully under Administration > System > Context Menu Actions in NW UI (For 11.x, Admin > System > Context Menu Actions).

If you are unsure of any of the steps above or experience any issues, contact RSA Support and quote this article number for further assistance.