The Archiver Packet Selective Retention feature is not currently supported in the 12.4 version

[#1]

Article Number

000003172

Applies To

RSA Product Set: NetWitness Platform
RSA Product/Service Type: Archiver and Packet Decoder/Hybrid
RSA Version/Condition: 12.4
Platform: AlmaOS

Issue

Please be advised that you may find the option to configure Packet Decoder/Hybrid on the Archiver in the NetWitness Platform Archiver Config page.

This feature was to be introduced starting in version 12.4 to allow packet decoders to use the same archiver collections for more optimized  storage retention. However, during testing, it was found that this feature would not support typical customer traffic loads due to current hardware limitations which would make it ineffective for most user scenarios. As a result, this feature is not currently supported in version 12.4.x and the UI was not updated to remove the option.

Therefore, NetWitness recommends that you do not attempt to use this feature in 12.4 at this time.

Image description

Image description

Resolution

Even though this functionality is currently not available in NetWitness version 12.4 it is still on the road map. This functionality is planned to be added at some point in a future release. To keep track of its availability, please check the NetWitness Release Notes for upcoming versions. Once this functionality has been implemented, this knowledge base article will also be updated.

NetWitness is sorry for any issues or confusion this may cause. If there are any questions, please reach out to NetWitness Support or your NetWitness Representative.