Article Number
000002083
Applies To
RSA Product Set: NetWitness Platform
RSA Product/Service Type: Log Collector
RSA Version/Condition: 11.7.1.0
Platform: CentOS
O/S Version: EL7
Issue
Post upgrading the NwLogCollector service to RSA NetWitness Platform 11.7.1.0, Windows Log Collection using WinRM stops working and gives the below errors related to NwLogCollector in /var/log/messages.
"2022-04-20T15:06:27","ERROR","WindowsCollection","","[domainname.eventsourcename] Error pulling events. Response code = 401/Unknown"
"2022-04-20T15:06:27","ERROR","WindowsCollection","","[domainname.eventsourcename] [processing] [WorkUnit] [processing] Unable to pull events from Windows event source <eventsourcename>: 401/Unauthorized.
Possible causes:
- Event source (eventsourcename) does not map to a Kerberos Realm."
"2022-04-20T15:06:27","ERROR","WindowsCollection","","[domainname.eventsourcename] [processing] [WorkUnit] [processing failure] windows:WrkUnit[2] Processing failed."
Also, when testing the connection to the configured WinRM Windows event sources, it fails giving the below error.
Error! 401/Unauthorized.
Possible causes:
- Event source (eventsourcename.domainname.com) does not map to a Kerberos Realm.
Cause
The cause of the issue is because of building the libcurl library without "--with-gssapi" flag, which is being used by the Windows collection.
Resolution
In order to resolve the issue, please download the following Hotfix RPM
https://sftp.rsa.com/human.aspx?Username=support&password=Password1&arg01=867812984&arg12=downloaddirect&transaction=signon&quiet=true and then, follow the below instructions.
1. Upload the Hotfix RPM to the node on which NwLogCollector Service is running.
2. SSH to the node on which NwLogCollector Service is running and login as root.
3. Run the below command in order to make a note of the existing installed version of the NwLogCollector Service.
rpm -qa | grep "nw-logcollector"
4. Stop the NwLogCollector Service by executing the below command.
systemctl stop nwlogcollector
5. Backup the current /usr/sbin/NwLogCollector file.
6. Install the Hotfix RPM by executing the below command.
rpm -Uvh rsa-nw-logcollector-11.7.1.0-15010.5.8c3052f26.el7.x86_64.rpm
7. Start the Log Collector service by executing the below command.
systemctl start nwlogcollector
Notes
This defect intended to be fixed in RSA NetWitness Platform 11.7.1.1
