This website uses cookies. By clicking Accept, you consent to the use of cookies. Click Here to learn more about how we use cookies.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
NetWitness Knowledge Base
Find answers to your questions and identify resolutions for known issues with knowledge base articles written by NetWitness experts.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- NetWitness Community
- Knowledge Base
- NetWitness Critical Services
-
Options
- Subscribe to RSS Feed
- Bookmark
- Subscribe
- Printer Friendly Page
- Report Inappropriate Content
NetWitness Critical Services
Article Number
000003101
Applies To
NetWitness Product Set: NetWitness Platform
NetWitness Product/Service Type: NetWitness Platform
NetWitness Version/Condition: 11.6.x and later
Platform: CentOS / AlmaLinux
O/S Version: 7 / 8.9
NetWitness Product/Service Type: NetWitness Platform
NetWitness Version/Condition: 11.6.x and later
Platform: CentOS / AlmaLinux
O/S Version: 7 / 8.9
Issue
The document lists the critical NetWitness related services.
Resolution
The following table provides details on the critical services used by the NetWitness platform:
For NetWitness service port information, refer https://community.netwitness.com/t5/netwitness-platform-online/network-architecture-and-ports/ta-p/668996.
The following are the Platform and Installation related logs that can be found on all devices:
For NetWitness service port information, refer https://community.netwitness.com/t5/netwitness-platform-online/network-architecture-and-ports/ta-p/668996.
| NW Service Dependencies | Service Name | Service Log Locations | Service Start/Stop Commands |
| Node-0: rabbitmq/nginx/jetty/security-server | Admin-Server | /var/log/netwitness/admin-server/admin-server.log | service rsa-nw-admin-server start/stop |
| Node-X: NA | Appliance | /var/log/netwitness/appliance/appliance.log | service nwappliance start/stop/status |
| Node-X: salt services (salt-minion, salt-master, salt-master) | Bootstrap is not a service | /var/log/netwitness/bootstrap/bootstrap.log | |
| Node-X: rabbitmq/collectd | Broker | /var/log/netwitness/broker/NwServerLog-000000001.log | service rsa-nw-broker start/stop/status |
| Node-0: NA | Config-Management | /var/log/netwitness/config-management/chef-solo.log and chef-client.log | service rsa-nw-config-management start/stop/status |
| Node-0: Security-Server/rabbitmq | Config-Server | /var/log/netwitness/config-server/config-server.log | service rsa-nw-config-server start/stop/status |
| Node-0: rabbitmq | Content- Server | /var/log/netwitness/content-server/content-server.log | service rsa-nw-content-server start/stop/status |
| Node-0: platform services | Failover is not a service | /var/log/netwitness/failover/nw-failover.log | |
| Security-server/log-decoder/ESA/respond-server/context-hub-server/rabbit-mq/nginx | Endpoint Server | /var/log/netwitness/endpoint-server/endpoint-server.log /var/log/netwitness/endpoint-server/endpoint-server.audit.log | service rsa-nw-endpoint-server start/stop/status |
| Node-0: security-server/rabbitmq | Integration-Server | /var/log/netwitness/integration-server/integration-server.log | service rsa-nw-integration-server start/stop/status |
| Node-0: rabbitmq/respond/nginx | Investigate Server | /var/log/netwitness/investigate-server/investigate-server.log | service rsa-nw-investigate-server start/stop/status |
| Node-0: rabbitmq | License Server | /var/log/netwitness/license-server/license-server.log | service rsa-nw-license-server start/stop/status |
| Node-X: Security-server | Node-infra-server | /var/log/netwitness/node-infra-server/node-infra-server.log | service rsa-nw-node-infra-server start/stop/status |
| Node-0: platform services | Nw-service-topology Not a service | /var/log/netwitness/nw-service-topology/nw-service-topology.log | |
| Node-X: platform services | Orchestration-client not a service | /var/log/netwitness/orchestration-client/orchestration-client.log | |
| Node-0: rabbitmq/mongod/ | Orchestration-server | /var/log/netwitness/orchestration-server/orchestration-server.log | service rsa-nw-orchestration-server start/stop/status |
| Node-X: platform services | Recovery-tool not a service | /var/log/netwitness/recovery-tool/recovery.log | |
| Node-0: | Respond-Server | /var/log/netwitness/respond-server/respond-server.log | service rsa-nw-respond-server start/stop/status |
| Node-0: NA | Root-ca-update is not service | /var/log/netwitness/root-ca-update/update.log and netwitness-key-repair.log | |
| Node-0: platform service | Security-client is not a service | /var/log/netwitness/security-client/security-client.log | |
| Node-0: rabbitmq | Security Server | /var/log/netwitness/security-server/security-server.log | service rsa-nw-security-server start/stop/status |
| Security-server/ Orchestration-server/ Endpoint-server/ Log-Decoder/ Network- Decoder/ Concentrator/ ESA- correlation -server/ rabbit-mq/ Nginx/ Service-topology/ Mongodb | Source Server | /var/log/netwitness/source-server/source-server.log | service rsa-nw-source-server start/stop/status |
| Node-0: | Standby-admin-sync not a service | /var/log/netwitness/standby-admin-sync/standby-admin-data-sync.log | |
| Node-0: audit Node-x: LD/LC logcollector/logdecoder | Logstash | /var/log/logstash/logstash-plain.log | service logstash start/stop/status |
| Node-X: | AuditLogs | /var/log/audit/audit.log | service auditd start/stop/status |
| Node-0: collectd/rsa-sms/platform services Node-X: collectd | RabbitMQ | /var/log/rabbitmq/rabbit@<node-id>.log and /var/log/rabbitmq/logs/crash.log | service rabbitmq-server start/stop/status |
| Node-X: rabbitmq/esa | MongoDB | /var/log/mongodb/mongod.log | service rsa-nw-mongodb start/stop/status |
| Node-X: Launch Jetty/admin-server | Nginx | /var/log/nginx/error.log and /var/log/nginx/access.log | service rsa-nw-nginx start/stop/status |
| Node-X: NA | SALT | /var/log/salt/api and /var/log/salt/key and /var/log/salt/master and /var/log/salt/minion | service salt-minion/salt-master/salt-api start/stop/status |
| Node-0: rabbitmq/collectd/logdecoder/jetty | SMS | /opt/rsa/sms/logs/sms.log and /opt/rsa/sms/wrapper.log | service rsa-sms start/stop/status |
| Node-X: rabbbitmq/collecd | LogCollector | /var/log/netwitness/logcollection/NwServerLog-000000001.log | service nwlogcollector start/stop/status |
| Node-X: rabbbitmq/collecd | LogDecoder | /var/log/netwitness/logdecoder/NwServerLog-000000001.log | service nwlogdecoder start/stop/satus |
| Node-X: rabbbitmq/collecd | Concentrator | /var/log/netwitness/concentrator/NwServerLog-000000001.log | service nwconcentrator start/stop/status |
| Node-X: rabbbitmq/collecd | Decoder | /var/log/netwitness/decoder/NwServerLog-000000001.log | service nwdecoder start/stop/status |
| Node-X: rabbbitmq/collecd | Archiver | /var/log/netwitness/archiver/NwServerLog-000000001.log | service nwarchiver start/stop/status |
| Node-X: rabbbitmq/collecd | Malware | /var/netwitness/malware-analytics-server/spectrum/logs/spectrum.log and /var/netwitness/malware-analytics-server/spectrum/logs/audit/audit.log | service rsa-nw-malware-analytics-server start/stop/status |
| Node-X: Rabbit-mq/ endpoint-server/security-server | EndPoint-Broker-Server | /var/log/netwitness/endpoint-broker-server/endpoint-broker-server.log and /var/log/netwitness/endpoint-broker-server/endpoint-broker-server.audit.log | service rsa-nw-endpoint-broker-server start/stop/status |
| Node-X: Nginx/Nchan/endpoint-server | Relay-server | /var/log/netwitness/relay-server/relay-server.log and /var/log/netwitness/relay-server/relay-server.audit.log | service rsa-nw-relay-server start/stop/status |
| Node-X: rabbbitmq/collecd/mongo | ESA | /var/log/netwitness/contexthub-server/contexthub-server.log and /var/log/netwitness/contexthub-server/contexthub-server.audit.log /var/log/netwitness/correlation-server/correlation-server.log and /var/log/netwitness/correlation-server/correlation-server.audit.log | service rsa-nw-contexthub-server start/stop/status service rsa-nw- correlation- server start/stop/status |
The following are the Platform and Installation related logs that can be found on all devices:
- /var/log/netwitness/bootstrap/nwsetup-tui.log
- /var/log/netwitness/config-management/chef-solo.log
- /var/log/netwitness/config-management/chef-client.log
- /var/log/netwitness/bootstrap/bootstrap.log
- /var/log/leapp/leapp-upgrade.log (OS Migration)
- /var/log/leapp/leapp-preupgrade.log (OS Migration)
No ratings
