Log collector File collection logs are not collected.

[#1]

Article Number

000039787

Applies To

RSA Product Set: RSA NetWitness Platform
RSA Product/Service Type: Security Analytics Server
RSA Version/Condition: 11.4, 11.5
Platform: Centos 7

Issue

All file collection logs are not incoming to NetWitness Log Collector.
File transfer error occurred with 'No such file or directory' in sasftpagent.log.

2021-07-01 16:45:30 ERROR Could not transfer /home/envisionsrv/var/lib/rsa/sasftpagent/stage/eventsource_1_2021-06-29_I1.txt-20210701164529-0.tmp to sftp@192.168.xxx.xxx:"/upload/eventsource_1/eventsource_1/eventsource_1_2021-06-29_I1.txt-20210701164529-0.tmp" via sftp.
2021-07-01 16:45:30 ERROR stdout: sftp> put "/home/envisionsrv/var/lib/rsa/sasftpagent/stage/eventsource_1_2021-06-29_I1.txt-20210701164529-0.tmp" "/upload/eventsource_1/eventsource_1/eventsource_1_2021-06-29_I1.txt-20210701164529-0.tmp"
2021-07-01 16:45:30 ERROR stderr: I've read & consent to terms in IS user agreement.
2021-07-01 16:45:30 ERROR stderr: remote open("/upload/eventsource_1/eventsource_1/eventsource_1_2021-06-29_I1.txt-20210701164529-0.tmp"): No such file or directory^M

In Log Collector, /upload/eventsource_1/eventsource_1/ directory exists under /var/netwitness/logcollector directory, but not /var/lib/logcollector directory.
Both of /var/netwitness/logcollector/upload/ and /var/lib/logcollector/upload/ should have same files and directories. But /var/lib/logcollector/upload is empty.

# ls /var/netwitness/logcollector/upload
apache  eventsource_1
# ls /var/lib/logcollector/upload
#

Cause

In /etc/fstab file, the line of /var/lib/logcollector/upload is commented.

# cat /etc/fstab
/dev/mapper/netwitness_vg00-root /                       xfs     defaults        0 0
UUID=23f99e6b-dc7b-46c9-85e7-180a8d52853d /boot                   xfs     defaults        0 0
/dev/mapper/netwitness_vg00-usrhome /home                   xfs     nosuid          0 0
/dev/mapper/netwitness_vg00-varlog /var/log                xfs     defaults        0 0
/dev/mapper/netwitness_vg00-nwhome /var/netwitness         xfs     nosuid,noatime  0 0
/dev/mapper/netwitness_vg00-swap swap                    swap    defaults        0 0
#/var/netwitness/logcollector/upload     /var/lib/logcollector/upload  none    bind    0       0
/var/netwitness/logcollector/upload     /var/lib/logcollector/upload_chroot/home/upload/eventsources  none    bind    0       0

 

Resolution

1. Open /etc/fstab. Remove the comment in the line of /var/lib/logcollector/upload. Then save and close.
   # vi /etc/fstab

2. Reload daemon.
   # systemctl daemon-reload

3. Mount the upload directory.
   # mount /var/lib/logcollector/upload