Error on stats page Could not retrieve stats in RSA NetWitness 10.4+

Issue

Appliance Stats page showing this error "could not retrieve stats"

Cause

This can be caused by the following :

A- nwappliance service not running 

B- Blocked ports from SA Head Units to Core Appliance 

C- Corrupt DH or cert files

D- Corrupt Stats DBs 

Resolution

Let us try resolving this in the same order as the causes above:

A- Start nwappliance on the appliance

B- Check connectivity from SA server to Core appliance's port using commands below:

If either above "curl" commands report connection refused , then Contact RSA Technical Support, quoting this KB 

C- Corrupt DH or cert files:

The files appliance_dh2048.pem or appliance_cert.pem can get corrupt which lead to the error shown in stats page. To check if the files are corrupt or not, run the following :

1- start the nwappliance in Debug mode :

2- examine the output file nwappliance,out. If you see errors such as:

OR
   

3- Then run the following :

D- Corrupt DB stats :

If after examining all above scenarios and still the error persists, then you can try removing the stats DB using the following :

1- stop nwappliance
2- rm -f /var/netwitness/appliance/statdb/*
3- start nwappliance

Product Details

RSA Product Set: Security Analytics
RSA Product/Service Type: SA Core Appliance
RSA Version/Condition: 10.4+

Approval Reviewer Queue

KCS Approval queue