Skip to content
  • There are no suggestions because the search field is empty.

How to change Hostname in RSA NetWitness Platform 11.3.x, 12.2.x, 12.3.x

Issue

The customer would like to change hostname in RSA NetWitness Platform 11.x., 12.2.x, 12.3.x


Resolution

From 11.3.x above, follow these steps to change hostname.

Before changing the hostname at the OS/GUI level, the /sys/config/service.name.override requires being updated on the service if the host is a Decoder (Log/Packet), Concentrator, Archiver, or Broker. This field should be filled in with the old hostname of the server. This prevents any errors with different systems trying to access data that was attached to the old hostname. The old hostname will continue to appear in query results with this activated. If there are any questions about this, please open a case with NetWitness Support before proceeding.
  1. In NW GUI got to ADMIN > Services > {Your Service} > View > Explore.
  2. Open the sys folder, then open the config folder.
  3. Within the config folder, find the service.name.override field.
  4. Place the new name in the field.
Let us say if you want to change the Decoder's hostname from "Decoder-A" to "Decoder-B". You will need to update /sys/config/service.name.override with the "Decoder-A" name. This step will prevent the re-indexing operation on Concentrators from taking place after changing the hostname of a connected Decoder.

OS Changes
  1. Run the following command to set the new hostname.
    # hostnamectl set-hostname <new hostname>

    Run the following to confirm the new hostname
    # cat /etc/hosts
    # cat /etc/hostname
  2. Reboot the host to make sure the name change has saved correctly.

If changing the hostname of an Admin Server (Node-0), the SMS service uses a lockbox file from /root/rsa/home/lockbox.ss and lockbox.ss.lock. These files need to be backed up to another location and then removed.
  1. Stop the SMS service on the Admin Server (node-0)
    # systemctl stop rsa-sms
  2. Make a backup of these two files /root/rsa/home/lockbox.ss and lockbox.ss.lock
    # mkdir /root/backup/
    # cp /root/rsa/home/lockbox.ss* /root/backup/
  3. Remove these two files /root/rsa/home/lockbox.ss and lockbox.ss.lock 
    # rm /root/rsa/home/lockbox.ss* 
  4. Start the SMS service on the node-0 (it will create new lockbox* files)
  5. # systemctl start rsa-sms


GUI Changes
  • NW GUI > ADMIN > Hosts, edit and save
  • NW GUI > ADMIN > Services, edit and save
Note: On Decoders, once you successfully changed the hostname, you need to reconfigure the connection between the Decoder and the Concentrator service. If the name change is for a Concentrator, you need to reconfigure the connection on the ESA and Report Engine.

If you are unsure of any of the steps above or experience any issues, contact RSA Support and quote this article number for further assistance.

Notes

For IP change, you can find the official document from https://community.rsa.com/docs/DOC-101667


Product Details

RSA Product Set: RSA NetWitness Platform
RSA Product/Service Type: Core Appliance
RSA Version/Condition: 11.3.x, 12.2.x, 12.3.x
Platform: CentOS
O/S Version: 7

Approval Reviewer Queue

Technical approval queue