Error on stats page "Could not retrieve stats" in RSA NetWitness 10.4+

[#1]

Article Number

000002047

Applies To

RSA Product Set: Security Analytics
RSA Product/Service Type: SA Core Appliance
RSA Version/Condition: 10.4+
 

Issue

Appliance Stats page showing this error "could not retrieve stats"

Cause

This can be caused by the following :

A- nwappliance service not running 

B- Blocked ports from SA Head Units to Core Appliance 

C- Corrupt DH or cert files

D- Corrupt Stats DBs 
 

Resolution

Let us try resolving this in the same order as the causes above:

A- Start nwappliance on the appliance

start nwappliance

B- Check connectivity from SA server to Core appliance's port using commands below:

- curl -v <appliance_ip>:50106
- curl -v <appliance_ip>:56006
- curl -v <appliance_ip>:50006

If either above "curl" commands report connection refused , then Contact RSA Technical Support, quoting this KB 

C- Corrupt DH or cert files:

The files appliance_dh2048.pem or appliance_cert.pem can get corrupt which lead to the error shown in stats page. To check if the files are corrupt or not, run the following :

1- start the nwappliance in Debug mode :

nohup /usr/sbin/Nwappliance > nwappliance.out

2- examine the output file nwappliance,out. If you see errors such as:

"There was an error loading the DH file /etc/netwitness/ng/appliance_dh2048.pem"

OR
 

"There was an error loading the DH file /etc/netwitness/ng/appliance_cert.pem"

 

3- Then run the following :

- stop nwappliance
- rm -f /etc/netwitness/ng/appliance_cert.pem
- rm -f /etc/netwitness/ng/appliance_dh2048.pem

4- start nwappliance

D- Corrupt DB stats :

If after examining all above scenarios and still the error persists, then you can try removing the stats DB using the following :

1- stop nwappliance
2- rm -f /var/netwitness/appliance/statdb/*
3- start nwappliance