Skip to content
  • There are no suggestions because the search field is empty.

Can't locate VMware/VIRuntime.pm error while running NwVmwareCollector.pl in RSA NetWitness Platform 

Issue

During Vmware event source configuration, below command used for checking debug errors.
perl /etc/netwitness/ng/logcollection/content/collection/vmware/vmware-events/NwVmwareCollector.pl -events -server <vmwareip> -username <username> -password <password> -count 1000

However, Running above command in Netwitness 11.X Log Collector throws below error.
Can't locate VMware/VIRuntime.pm in @INC (@INC contains: /usr/local/lib64/perl5 /usr/local/share/perl5 /usr/lib64/perl5/vendor_perl /usr/share/perl5/vendor_perl /usr/lib64/perl5 /usr/share/perl5 .) at /etc/netwitness/ng/logcollection/content/collection/vmware/vmware-events/NwVmwareCollector.pl line 8.
BEGIN failed--compilation aborted at /etc/netwitness/ng/logcollection/content/collection/vmware/vmware-events/NwVmwareCollector.pl line 8.

Cause

This is due to that from 11.0 onwards, we have changed the rsa-nw-logcollector-perl rpm. It no longer updates the system perl areas. Instead, it installs the needed perl components in /opt/netwitness/ area. Please see the systemd configuration below which sets the needed PERL5LIB environment variable:
[root@VLC ~]# more /usr/lib/systemd/system/nwlogcollector.service
[Unit]
Description=Netwitness LogCollector

[Service]
ExecStart=/usr/sbin/NwLogCollector
Environment=LD_LIBRARY_PATH=/opt/netwitness/lib:/opt/netwitness/odbc/lib:/usr/lib64:$LD_LIBRARY_PATH
Environment=ODBCINI=/etc/netwitness/ng/odbc.ini
Environment=ODBCINST=/opt/netwitness/odbc/odbcinst.ini
Environment=PERL5LIB=/opt/netwitness/perl5/lib/perl5
Restart=always
StartLimitInterval=300
StartLimitBurst=10
StandardOutput=null
TimeoutStopSec=600
WorkingDirectory=/var/netwitness/logcollector/metadb
LimitCORE=infinity
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target

Resolution

Please follow below steps to fix the issue.
  1. Login to Log Collector Putty using root credentials.
  2. Run below command to set the environment variable. export PERL5LIB=/opt/netwitness/perl5/lib/perl5
  3. Then try running below command to check debug errors if there are any.
perl /etc/netwitness/ng/logcollection/content/collection/vmware/vmware-events/NwVmwareCollector.pl -events -server <vmwareip> -username <username> -password <password> -count 1000

Product Details

RSA Product Set: NetWitness Platform 
RSA Product/Service Type: Log Collector
RSA Version/Condition: 11.1.0.3
Platform: CentOS
O/S Version: 7

Summary

This article outlines the procedure for running NwVmwareCollector.pl in Netwitness 11.X Log Collector.


Approval Reviewer Queue

RSA NetWitness Suite Approval Queue