Investigate-NAVIGATE page returns "System error" after upgrading RSA NetWitness Admin Server to 11.6.0.0

[#1]

Article Number

000039730

Applies To

RSA Product Set: RSA NetWitness Platform
RSA Product/Service Type: Security Analytics Server
RSA Version/Condition: 11.6.0.0
Platform: CentOS
O/S Version: 7
 

Issue

After upgrading the Admin Server from 11.5.x to 11.6.0.0, opening Investigate-NAVIGATE page shows the error below.

System error
Error Description:
An error occurred while processing your request. Please return to the previous page and check everything before trying again.

Image description

Other pages including, Investigate-EVENTS and Investigate-LEGACY EVENTS(if enabled), are successfully loaded.

/var/log/netwitness/investigate-server/investigate-server.log does not show any relevant messages.
However, the following logs may be noticed when the issue is replicated.

/var/netwitness/uax/logs/sa.log

2021-06-09 23:11:11,061 [qtp815992954-35] WARN org.springframework.web.servlet.PageNotFound - No mapping for GET /favicon.ico

/var/log/messages

Jun 9 23:29:00 nwserver nw-jetty-wrapper.sh: 2021-06-09 23:29:00.786:WARN:oejs.HttpChannel:qtp815992954-1243: /investigation/navigate
Jun 9 23:29:00 nwserver nw-jetty-wrapper.sh: java.lang.RuntimeException: org.springframework.web.util.NestedServletException: Request processing failed; netsted exception is com.rsa.asoc.launch.api.transport.TransportException: No handler found for message

The following error is also noticed in /var/netwitness/uax/logs/sa.log while restarting jetty service.

2021-06-10 00:29:06,334 [qtp815992954-46] ERROR com.rsa.smc.sa.investigation.common.service.impl.DefaultInvestigationOOTBServiceImpl - Error in creating Investigation OOTB Content for user
org.hibernate.exception.SQLGrammarException: could not prepare statement
...
Caused by: org.h2.jdbc.JdbcSQLException: Column "METALANGUA0_.METAGROUP_ID" not found; SQL statement:
...

 

Cause

The issue occurs when the Admin Server is upgraded to 11.6.0.0 but ESA hosts remain at an older version.

As per the Upgrade Options document, all ESA hosts need to be upgraded to 11.6.0.0 for the NetWitness services to function properly.

Mixed Mode Unsupported for ESA Hosts
Mixed mode is not supported for ESA hosts in NetWitness Platform version 11.5 and later. The NetWitness server, ESA primary host, and ESA secondary host must all be on the same NetWitness Platform version.

 

Resolution

As it is expected and normal to see Investigate-NAVIGATE returning "System error", please continue upgrading all ESA hosts in the environment to 11.6.0.0.