NetWitness Event Analysis/Events page stuck as Loading Services due to incorrect syslog configuration

[#1]

Article Number

000038051

Applies To

RSA Product Set: NetWitness Logs & Network
RSA Product/Service Type: Event Stream Analysis
RSA Version/Condition: 11.3.X,11.4.X, 11.5.X

Issue

Event Analysis/Events page stays loading services as below. Drop-down could not select desired service even if target date and time are changed.

Image description

investigate-server.log:

2021-05-18 07:35:47,800 [      clientInboundChannel-435] WARN            DataAccess|Failed to retrieve data
java.lang.NullPointerException: null

In Node-Zero:
orchestration-cli-client -s command fails with java.lang.NullPointerException: null

Cause

This could be due to import of syslog configuration from different server and the node ID of node zero is not updating accordingly for mongo database.

Resolution

Please follow below steps to update mongo database with correct Node-zero details.

1. Login to Node-Zero and run below commands.

   mongo admin -u deploy_admin -p <password>
   use orchestration-server
   db.getCollection('service').find({ "name" : "syslog" })

   Example output:

   { "_id" : "4f738dd7073543a19ea64dcacfe67ece", "name" : "syslog", "host" : DBRef("host", "266208404d0c42cdb9e95f678e138e8d"), "port" : 514, "useTls" : false, "family" : "third-party", "meta" : { "template" : "%{timestamp}|%{deviceService}|%{deviceVendor}|%{deviceProduct}|%{deviceVersion} [audit] Event Category: %{category} Operation: %{operation} Outcome: %{outcome} Description: %{text} User: %{identity} Role: %{userRole} src=%{sourceAddress} spt=%{sourcePort} index:%{parameters} url:%{referrerUrl}", "outputType" : "rsaudp", "facility" : "AUTH" }, "_class" : "com.rsa.asoc.orchestration.service.ServiceEntity" }

   { "_id" : "53f95cd3cdc549fda2e932f9d4725ca7", "name" : "syslog", "host" : DBRef("host", "8520bbd7eee64e0aaadbd85066957f8d"), "port" : 514, "useTls" : false, "family" : "third-party", "meta" : { "template" : "%{timestamp}|%{deviceService}|%{deviceVendor}|%{deviceProduct}|%{deviceVersion} [audit] Event Category: %{category} Operation: %{operation} Outcome: %{outcome} Description: %{text} User: %{identity} Role: %{userRole} src=%{sourceAddress} spt=%{sourcePort} index:%{parameters} url:%{referrerUrl}", "outputType" : "rsaudp", "facility" : "AUTH" }, "_class" : "com.rsa.asoc.orchestration.service.ServiceEntity" }

2. Get the node-id of Node-zero by running helow command.

   cat /etc/salt/minion
   
   Example:  "0160ffae-086b-4b17-9203-3e64bbf6d95f"

3. For all the syslog configurations in point 1, run the below command:

   
   db.getCollection('service').update({"_id" : "<syslog service id>"}, {$set: { "host" : DBRef("host", "<Node-Zero nodeid>")}});

   Example:
   
   db.getCollection('service').update({"_id" : "4f738dd7073543a19ea64dcacfe67ece"}, {$set: { "host" : DBRef("host", "0160ffae-086b-4b17-9203-3e64bbf6d95f")}});