NetWitness appliance upgrade fails due to NFS type File System mount in 12.4 and above

[#1]

Article Number

000003150

Applies To

RSA Product Set: NetWitness Platform
RSA Product/Service Type: All nodes
RSA Version/Condition: 12.4 or later
Platform: Alma Linux
 

Issue

NetWitness appliance upgrade fails when the system has NFS type file system mount.

Sample NFS file system in the Netwitness system (Highlighted)

#df -h
Filesystem                            Size  Used Avail Use% Mounted on
devtmpfs                               63G     0   63G   0% /dev
tmpfs                                  63G  460K   63G   1% /dev/shm
tmpfs                                  63G  1.9G   61G   3% /run
tmpfs                                  63G     0   63G   0% /sys/fs/cgroup
/dev/mapper/netwitness_vg00-root       30G  5.0G   26G  17% /
/dev/sda1                            1014M  107M  908M  11% /boot
/dev/mapper/netwitness_vg00-varlog     10G  2.1G  8.0G  21% /var/log
/dev/mapper/netwitness_vg00-nwhome    2.7T  753G  2.0T  28% /var/netwitness
/dev/mapper/netwitness_vg00-usrhome    10G   33M   10G   1% /home
/dev/mapper/archiver-database0         29T   29T   23G 100% /var/netwitness/archiver/database0
/dev/mapper/archiver1-database1        19T   16T  3.1T  84% /var/netwitness/archiver/database1
/dev/mapper/archiver2-database2        30T   27T  3.1T  90% /var/netwitness/archiver/database2
10.1.11.1:/SIEM_DR_ColdStorage_new   20T   11T  7.8T  59% /mystoragebackup
tmpfs                                  13G     0   13G   0% /run/user/0

 

 

Resolution

Please follow the below steps to unmount NFS mount points from the CLI.

1. SSH to the NetWitness system where the NFS filesystem is mounted.
2. Stop the Netwitness service on the server that is using the NFS mount to store data.

An example for an Archiver, run the following to stop the nwarchiver service:

# systemctl stop nwarchiver

3. Use the following command to unmount the mount point.

# umount -l <dir_path> 

Here, <dir_path> is the path of the directory using the NFS filesystem.

Example:

# umount -l /mystoragebackup

4. Once the NetWitness appliance upgrade is completed and the reboot is done, the NFS-type file system mounts back automatically if /etc/fstab has an entry for this NFS filesystem. NFS file system mount can be verified using df -h command.