Troubleshooting New Health and Wellness

This topic describes how to troubleshoot New Health and Wellness issues.

Issue

An error ‘n of m shards failed’ or ‘unknown field in the index’ in the New Health and Wellness dashboards.

Resolution

Refresh the index patterns, perform the following:

  1. Log in to NetWitness Platform.
  2. Go to netwitness_adminicon_25x22.png (Admin) > Health & Wellness.
  3. Click New Health & Wellness.
  4. Click Pivot to Dashboard.
  5. Go to netwitness_newhwhom_23x27.png > Stack Management > Index Patterns.
  6. Click nw* index pattern.
  7. Click Refresh to refresh the index pattern on top right corner.

Note: If the issue still persists, refresh other index patterns such as nw-metricbeat* or nw-concentrator* and so on.

Issue

Unable to send data to elastic search once disk usage reaches 85%.
Explanation

If the Elasticsearch disk usage reaches 85%,

the saved objects (index patterns, dashboards, visualizations etc) becomes read-only mode.

And, services does not write new metrics to Elasticsearch or allow to edit any saved objects.
Resolution To change the indexes to write mode, execute the following command on the host in which Elasticsearch is installed:
curl -k --cert /etc/pki/nw/elastic/elasticsearch-cert.pem --key /etc/pki/nw/elastic/elasticsearch-key.pem -X PUT -H "Content-Type: application/json" -d '{"index.blocks.read_only_allow_delete": null }' https://localhost:9200/_all/_settings

Note: This command is supported only with certificates.


Issue New Health and Wellness > Pivot to Dashboard fails due to time synchronization issue.
Explanation Pivot to dashboard fails if there is no time synchronization between the NetWitness Server and the host on which New Health and Wellness is installed.
Resolution

You must synchronize the time and pivot to dashboard. To synchronize the time do one of the following:

  • Configure the NTP Server. For more information, see "Configure NTP Servers" in the System Configuration Guide.
  • Run the following commands on the host on which New Health and Wellness is installed
    1. SSH to NetWitness host.
    2. Run the following commands.
      • systemctl stop ntpd
      • ntpdate nw-node-zero
      • systemctl start ntpd

Issue NW Host High Swap Utilization monitor generates many false alerts.
Explanation

By default the set threshold is > 50 %, which might generate many false alerts on NW Host High Swap Utilization monitor for Linux hosts, which is considered normal.

Note: On upgrade to 11.5.3.0 version or later, the monitor will be automatically deleted on the New Health & Wellness monitors view.
Resolution

On version 11.5.2.0 or lower, you can perform the following steps to delete the monitor:

  1. Log in to the NetWitness Platform.

  2. Go to (missing or bad snippet)> Health & Wellness.

  3. Click New Health & Wellness.
  4. Click Pivot to Dashboard.

    The Deployment Health Overview dashboard is displayed.

  5. Go to netwitness_newhwhom_23x27.png > Open Distro for Elasticsearch > Alerting.
    The Dashboards tab is displayed by default.

  6. Click Monitors tab.
  7. Select the NW Host High Swap Utilization monitor and click netwitness_action_delete_56x22.png > Delete.
    The monitor is deleted.