Article Number
000003194
Applies To
NetWItness Product Set: Security Analytics, NetWitness
NetWItness Product/Service Type: NW Platform
NetWItness Version/Condition: 11.x, 12.x
Platform: CentOS 7 / Alma
Issue
There are circumstances when it is required to shutdown an appliance. These can be RMA replacement, Datacenter move, among others.
Resolution
- Navigate to Admin > Services > Click on Gear under Actions column > View > Config page of installed service on the host
- Stop Aggregation/Capture
Stop Aggregation in case the installed service is one of : Broker, Concentrator, Archiver
Stop Capture in case of Log/Packet Decoder
- SSH to the Host and stop all the services: (Ex: nwappliance, nwbroker, nwconcentrator, nwlogdecoder, nwlogcollector, nwdecoder, collectd, mongod, rsasoc_re, nwarchiver, rsa-nw-endpoint-server)
#systemctl stop <Service Name>
- Shutdown the OS and power off the appliance:
#shutdown -h now
- If the appliance did not power off after the shutdown command, press the power Button to shut it down
Note: Complete the following steps If there is an attached External Storage:
- Wait at least 5 minutes and confirm that all disk activity on the PowerVault has ended. Monitor the LED lights on the PowerVault to confirm disk I/O activity has ceased.
- Power off any connected PowerVault
Notes
When you are starting the Appliance again :
1. Turn on the power to each PowerVault and allow it to power up.
2. Turn on the power to the appliance and allow it to boot.
