Skip to content
  • There are no suggestions because the search field is empty.

How to reset the statistics on an RSA NetWitness Platform core services

Issue

Resetting the stat DB may be required if a core service's stats are not updated with the current/expected values or for some other reasons.
The core service's stats can be viewed from the following locations.
For SA 10.x: Administration-> Services-> Explore(of the core service)->/ /stats.
For NW 11.x: ADMIN- Services-> Explore(of the core service)->/ /stats.
e.x. /decoder/stats or /concentrator/stats.

Tasks

In order to reset the statistics on a core service such as a decoder or a concentrator, please follow the steps below.
  1. In the Security Analytics UI or NetWitness UI, navigate to Administration(SA 10.x) or ADMIN(NW 11.x) -> Services.
  2. Select the core service, click on the Actions button, and select View ->Explore.
  3. In the Explore view, right-click on the core service directory in the left pane and select Properties.
  4. In the drop-down menu in the lower-right pane, select reset.
  5. In the Parameters field, enter stats=1 and click the Send button.
Be advised that resetting the statistics will automatically restart the core service on the appliance.

  User-added

Notes

Alternatively, the  resetMax option may be used instead to only clear the maximum statistical values, such as capture.dropped.percent.max, capture.packet.rate.max, etc.
While it will not clear all statistics, it is the less intrusive option as it does not require a service restart to be performed.

User-added

Product Details

RSA Product Set: RSA NetWitness Platform
RSA Product/Service Type: Core services
RSA Version/Condition: 10.x, 11.x

Approval Reviewer Queue

RSA NetWitness Suite Approval Queue