Appendix A. Troubleshooting
Appendix A. TroubleshootingAppendix A. Troubleshooting
This section describes solutions to problems that you may encounter during installations and upgrades. In most cases, NetWitness creates log messages when it encounters these problems.
Note: If you cannot resolve an upgrade issue using the following troubleshooting solutions, contact Customer Support (https://community.netwitness.com/t5/support-information/how-to-contact-netwitness-support/ta-p/563897).
This section has troubleshooting documentation for the following services, features, and processes.
Go to the NetWitness All Versions Documents page and find NetWitness Platform guides to troubleshoot issues.
Command Line Interface (CLI)Command Line Interface (CLI)
- Column 1: Error Message
- Column 2:
Command Line Interface (CLI) displays: "Orchestration failed."
Mixlib::ShellOut::ShellCommandFailed: Command execution failed. STDOUT/STDERR suppressed for sensitive resource in/var/log/netwitness/config-management/chef-solo.log
- Column 1: Cause
- Column 2: Entered the wrong deploy_admin password in nwsetup-tui.
- Column 1: Solution
- Column 2:
Retrieve your deploy_admin password.
- SSH to the NW Server host.
security-cli-client --get-config-prop --prop-hierarchy nw.security-client --prop-name deployment.password
SSH to the host that failed. - Run the nwsetup-tui again using correct deploy_admin password.
- SSH to the NW Server host.
- Column 1: Error Message
- Column 2: ERROR com.rsa.smc.sa.admin.web.controller.ajax.health.
AlarmsController - Cannot connect to System Management Service
- Column 1: Cause
- Column 2: NetWitness sees the Service Management Service (SMS) as down after successful upgrade even though the service is running.
- Column 1: Solution
- Column 2: Restart SMS service.
systemctl restart rsa-sms
- Column 1: Error Message
- Column 2:
You receive a message in the User Interface to reboot the host after you update and reboot the host offline.
- Column 1: Cause
- Column 2: You cannot use CLI to reboot the host. You must use the User Interface.
- Column 1: Solution
- Column 2:
Reboot the host in the Host View in the User Interface.
Event Stream Analysis Event Stream Analysis
For ESA Correlation troubleshooting information, see the Alerting with ESA Correlation Rules User Guide.
The Western Digital Ultrastar Data 60 (UsD-60) is a high-density, rack-mounted storage enclosure available in a 4U form factor. It has the capacity to hold 60 drives.
Additional Documentation References
- Western Digital's documentation for the Ultrastar Data60 is available at the following location Ultrastar Data60 Hybrid Storage Platform.
- Adaptec SmartRAID documentation is available under the Documentation tab at the following location Microchip Technology.
Hardware Requirements
The UsD-60 requires the following hardware configuration:
- NetWitness Series 7
- Adaptec SmartRAID Adapter
- Mini-SAS cables
NetWitness Configuration Guidelines
Zoning: Each UsD-60 supports up to five NetWitness appliances connected simultaneously by using the Ultrastar’s zoning feature.
Cabling: Each NetWitness appliance requires at least two mini-SAS connections: a primary connection and a backup connection. When both cables are functioning properly, they are used simultaneously for communication with the UsD-60. When connecting the mini-SAS cables, make sure the cables on side A match the corresponding numbers on side B. For example, cables A1 and B1 would be connected to a single NetWitness appliance.
Warning: The Ultrastar-connected mini-SAS cable must not be attached to the NetWitness Hybrid appliance until the orchestration is complete. Connecting the cable beforehand will cause orchestration to fail.
The following figure shows the error when attempting orchestration while the Ultrastar is connected to the NetWitness Hybrid appliance.

IMPORTANT: If the Ultrastar-connected mini-SAS cable was attached before orchestration, you must disconnect the mini-SAS cable from the NetWitness Hybrid appliance and re-image the appliance to resolve the issue.
Zoning Configuration
The UsD-60 contains 60 hard drives in five columns of 12 drive physical configuration.

These drives can be divided into separate zones, ensuring that each connected NetWitness device can access only its designated zone.
Predefined Zones
NetWitness uses seven predefined zoning configurations based on files. These file-based zoning configurations must not be combined with any other zoning configuration methods. When file-based zoning is enabled, it will override all other zoning methods after a system reboot. Zone files can be downloaded from this location NetWitness Zone Configuration on Western Digital Ultrastar 60 Download.
IMPORTANT:
-The colors in the Disks column align with those in the Interface column, showing the connection between each disk group and its corresponding interface. Make sure the colors on the left match those on the right for each Zoning configuration.
- Each color in the Zone Configurations indicates the unique NetWitness appliances and the connections corresponding to those appliances.
Zone Configuration 0
The UsD-60 comes pre-configured from the factory with a default zone setup. This configuration allows all drives to be accessible from all interfaces on the Ultrastar.

Zone Configuration 1
This configuration uses a 1x1x1x1x1 setup and supports up to five NetWitness devices simultaneously. Each device can access only a maximum of 12 drives.
Zone Configuration 2
This configuration uses a 2x1x1x1 setup and supports up to four NetWitness devices simultaneously.

Zone Configuration 3
This configuration uses a 3x1x1 setup and supports up to three NetWitness devices simultaneously.

Zone Configuration 4
This configuration uses a 4x1 setup and supports up to two NetWitness devices simultaneously.
Zone Configuration 5
This configuration uses a 2x2x1 setup and supports up to three NetWitness devices simultaneously.

Zone Configuration 6
This configuration uses a 3x2 setup and supports up to two NetWitness devices simultaneously.

Configure Zones Commands
The WDDCS utility must be used to configure a zone. The complete list of steps is available in the zone file (File-Based Zoning) section under the User Guide - WDDCS Tool in the following location Ultrastar Data60 Hybrid Storage Platform.
Configure Partitions and Virtual Disks on WD Ultrastar 60 for NetWitness Appliances
For more information on manually creating partitions, disks or deleting existing mount points, refer to the KB article Manage Mount Points, Virtual Disks, and Partitions Configuration on WD Ultrastar 60 for NetWitness Appliances.
WDDCS and ARCCONF Commands Usage
wddcs commands
The wddcs tool allows users to send commands to the UsD-60. For a complete list of wddcs commands, refer to the Western Digital’s User Guide - WDDCS Tool available at the following location Ultrastar Data60 Hybrid Storage Platform. The following list contains a selection of commonly used commands for quick reference.
wddcs show
Provides the device locations (/dev/sgXX), which correspond to the Ultrastar appliance devices.
wddcs /dev/sgXX getlog all
Provides the Western Digital’s version of sosreport for Ultrastar and will be required for any Customer Support tickets related to Ultrastar.
wddcs /dev/sgXX zone file=
Configures the Ultrastar zone using the .bin files provided by NetWitness.
wddcs /dev/sgXX zone status
Retrieves the current zone configuration for the Ultrastar.
arcconf commands
The arcconf tool allows users to send commands to the SmartRAID Adapter. For a complete list of all arcconf commands, refer to the Microchip’s ARCCONF Command Line User's Guide available under the Documentation tab at the following location Microchip Technology. The following list contains a selection of commonly used commands for quick reference.
arcconf list
Provides a list of all Adaptec RAID adapters
arcconf list
Provides a list of drives connected to RAID adapter <#>, along with their RAID status.
arcconf rescan
Rescans any hard drives on RAID adapter <#>. This can be useful if significant changes have been made to the RAID adapter configuration, and the updated information is not accurately reflected in the output of the arcconf list
arcconf getstatus
Provides updates on any background tasks that the RAID adapter
arcconf savesupportarchive
Generates and copies all log files to the
If you need further assistance with any issues, please contact the NetWitness Customer Support team for troubleshooting.