Delay in Loading NetWitness Investigate > Events Page in NetWitness 11.7 and later

[#1]

Article Number

000003136

Applies To

RSA Product Set: NetWitness Platform XDR
RSA Product/Service Type: Investigate
RSA Version/Condition:  11.7 and later

 

Issue

Users will experience a delay while loading the Investigate > Events page as below.

Image description

As a result, users cannot select a service and execute the query until the SDK call to fetch the core services list is successful or times out.

Cause

The issue can occur under any of the following circumstances:

• When you power off hosts directly from the VCD/ESXi control UI or any other deployment platform.
• When you power off the host before turning off core services (decoder/concentrator/broker).
• When the host is powered off abruptly.

Resolution

NetWitness recommends its users turn off the hosts by following any one of the methods mentioned below:

• ssh to the host, run shutdown -h now command, and wait for the server to show shutdown.
• Use the Shutdown Guest OS option available on the VCD/ESXi or any other deployment platform that has a UI to shut down the host such as AWS or EC2 instances.
• ssh to the host and run the Linux command to turn off the core services (nwlogcollector,nwlogdecoder,nwconcentrator,nwdecoder,nwbroker,nwappliance) before shutting down the host.

example command to stop core service in ssh:
service nwlogcollector stop