Article Number
000003116
Applies To
RSA Product Set: NetWitness Log and Network
RSA Product/Service Type: Administration
RSA Version/Condition:11.x , 12.x
Issue
Looking for how to completely remove a host that is no longer being used by NetWitness.
Resolution
Please follow these steps to remove the unwanted host:
-
Remove the host from the UI using the steps mentioned in Knowledge Base Article Hosts View (By clicking on the delete button and confirming removal).
-
SSH to the host that you want to remove (Broker, Concentrator, Decoder, Archiver, ESA, etc.).
-
Run the command and copy the ID that is displayed.
# cat /etc/salt/minion
-
SSH into the Admin server and run the following command to remove the salt-key entry.
# orchestration-cli-client --remove-key <ID displayed from previous step>
Ex) orchestration-cli-client --remove-key 1d8aa9ec-8471-439d-87d9-9c645a0b3337
-
Run the following command on the Admin server to remove the RabbitMQ federations for the host.
# rabbitmqctl -q clear_parameter -p /rsa/system federation-upstream carlos-upstream-<ID displayed previously>
Ex) rabbitmqctl -q clear_parameter -p /rsa/system federation-upstream carlos-upstream-1d8aa9ec-8471-439d-87d9-9c645a0b3337
Notes
It is Best Practice to remove hosts completely from the Admin server when decommissioning hosts. Leaving these hosts in the Admin server databases may lead to problems with Salt and RabbitMQ. These old hosts can cause issues with the upgrade precheck script and when running the cert-reissue command. It is recommended to perform these steps to keep the databases clean and running effectively.
