Skip to content
  • There are no suggestions because the search field is empty.

Examples of common commands and their outputs within NwConsole

Tasks

During troubleshooting it is often useful to monitor a value over time to see if there is an improvement. For example, you may be interested in the number of sessions behind on an archiver over a period of time in order that you can see if it is decreasing.

A handy way of doing this is to write a script to capture values.

First, identify the value that you are interested in by going to the Explore view on the device or using the NwConsole utility.
These commands can then be scripted as shown below.

The following script should be saved as getstats.sh and placed in the /etc/cron.hourly directory.
it should be given executable permissions (eg chmod +x /etc/cron.hourly/getstats.sh)
NOTE:  The script assumes that the default credentials are being used.
date >> /tmp/stats.txt
NwConsole -c login 10.180.99.10:50002 admin netwitness -c netspeed count=100 >>/tmp/stats.txt
NwConsole -c login localhost:50008 admin netwitness -c cd /archiver/devices/10.180.99.10:50002/stats -c ls >>/tmp/stats.txt

Every hour it will run and produce results in /tmp/stats.txt which can then be reviewed.

After troubleshooting, be sure to remove the getstats.sh file from the /etc/cron.hourly directory.

Notes

Below is an example of various NwConsole commands.

Tue Jan 20 13:14:02 UTC 2015
RSA Security Analytics Console 10.3.4.2634
Copyright 2001-2013, RSA Security Inc. All Rights Reserved.

>login 10.180.99.10:50002 admin netwitness
Successfully logged in as session 35275
>netspeed count=100
Receiving at 379.82 KBs/second
Receiving at 397.52 KBs/second
Receiving at 444.44 KBs/second
Receiving at 620.16 KBs/second
Receiving at 703.94 KBs/second
Receiving at 401.43 KBs/second
Receiving at 372.40 KBs/second
Receiving at 358.54 KBs/second
Receiving at 388.89 KBs/second
Receiving at 339.22 KBs/second
Receiving at 355.89 KBs/second
Receiving at 346.88 KBs/second
Receiving at 332.18 KBs/second
Receiving at 407.64 KBs/second
RSA Security Analytics Console 10.3.4.2634
Copyright 2001-2013, RSA Security Inc. All Rights Reserved.

>login localhost:50008 admin netwitness
Successfully logged in as session 8854
>cd /archiver/devices/10.180.99.10:50002/stats
[localhost:50008] /archiver/devices/10.180.99.10:50002/stats
>ls
meta.rate (Meta Rate (current)) = 0
meta.rate.max (Meta Rate (maximum)) = 38684
session.rate (Session Rate (current)) = 0
session.rate.max (Session Rate (maximum)) = 2208
sessions.behind (Sessions Behind) = 204924525
status (Status) = consuming
time.last (Last Session Time) = 1421500128
time.network (Aggregation Network Time (current)) = 0
time.network.max (Aggregation Network Time (maximum)) = 257312
Tue Jan 20 14:01:01 UTC 2015
RSA Security Analytics Console 10.3.4.2634
Copyright 2001-2013, RSA Security Inc. All Rights Reserved.

>login 10.180.99.10:50002 admin netwitness
Successfully logged in as session 48043
>netspeed count=100
Receiving at 809.39 KBs/second
Receiving at 760.40 KBs/second
Receiving at 676.27 KBs/second
Receiving at 575.42 KBs/second
Receiving at 574.28 KBs/second
Receiving at 654.28 KBs/second
Receiving at 754.99 KBs/second
Receiving at 549.09 KBs/second
Receiving at 501.96 KBs/second
RSA Security Analytics Console 10.3.4.2634
Copyright 2001-2013, RSA Security Inc. All Rights Reserved.

>login localhost:50008 admin netwitness
Successfully logged in as session 20333
>cd /archiver/devices/10.180.99.10:50002/stats
[localhost:50008] /archiver/devices/10.180.99.10:50002/stats
>ls
meta.rate (Meta Rate (current)) = 19727
meta.rate.max (Meta Rate (maximum)) = 40573
session.rate (Session Rate (current)) = 1109
session.rate.max (Session Rate (maximum)) = 2219
sessions.behind (Sessions Behind) = 207251299
status (Status) = consuming
time.last (Last Session Time) = 1421502313
time.network (Aggregation Network Time (current)) = 169984
time.network.max (Aggregation Network Time (maximum)) = 379913
Tue Jan 20 14:14:01 UTC 2015
RSA Security Analytics Console 10.3.4.2634
Copyright 2001-2013, RSA Security Inc. All Rights Reserved.

>login 10.180.99.10:50002 admin netwitness
Successfully logged in as session 48540
>netspeed count=100
Receiving at 911.68 KBs/second
Receiving at 1.14 MBs/second
Receiving at 669.20 KBs/second
Receiving at 0.98 MBs/second
Receiving at 747.81 KBs/second
Receiving at 892.43 KBs/second
Receiving at 803.09 KBs/second
RSA Security Analytics Console 10.3.4.2634
Copyright 2001-2013, RSA Security Inc. All Rights Reserved.

>login localhost:50008 admin netwitness
.....

Product Details

NetWitness Product Set: NetWitness Platform
NetWitness Product/Service Type: All Nodes
NetWitness Version/Condition: 11.x, 12.x or later
Platform: CentOS , AlmaLinux


Approval Reviewer Queue

Technical approval queue