How to stop unneeded respond-server logs in RSA NetWitness Platform

Issue

Customer have faced a lot of respond-server related logs like followings after upgraded 11.3.x from 10.6.x.
--------

 Sep 6 10:09:39 cwx0NFS3001 respond-server.jar: at com.mongodb.internal.connection.BaseCluster.getDescription(BaseCluster.java:179)
 
Sep 6 10:09:39 cwx0NFS3001 respond-server.jar: at com.mongodb.internal.connection.MultiServerCluster.getDescription(MultiServerCluster.java:54)
 
Sep 6 10:09:39 cwx0NFS3001 respond-server.jar: at com.mongodb.client.internal.MongoClientDelegate.getConnectedClusterDescription(MongoClientDelegate.java:136)
 
Sep 6 10:09:39 cwx0NFS3001 respond-server.jar: at com.mongodb.client.internal.MongoClientDelegate.createClientSession(MongoClientDelegate.java:94)
 
Sep 6 10:09:39 cwx0NFS3001 respond-server.jar: at com.mongodb.client.internal.MongoClientDelegate$DelegateOperationExecutor.getClientSession(MongoClientDelegate.java:249)
 
Sep 6 10:09:39 cwx0NFS3001 respond-server.jar: at com.mongodb.client.internal.MongoClientDelegate$DelegateOperationExecutor.execute(MongoClientDelegate.java:172)
 
Sep 6 10:09:39 cwx0NFS3001 respond-server.jar: at com.mongodb.client.internal.MongoIterableImpl.execute(MongoIterableImpl.java:132)
 
Sep 6 10:09:39 cwx0NFS3001 respond-server.jar: at com.mongodb.client.internal.MongoIterableImpl.iterator(MongoIterableImpl.java:86)
 
Sep 6 10:09:39 cwx0NFS3001 respond-server.jar: at org.springframework.data.mongodb.core.MongoTemplate.executeFindMultiInternal(MongoTemplate.java:2667)
 
Sep 6 10:09:39 cwx0NFS3001 respond-server.jar: ... 37 common frames omitted

--------

This customer uses NW since 10.3.x so they don't have ESA. Therefore they want to stop these unneeded logs as those logs might impact to log size/quick log rotation and bother to find an issue on log.

Resolution

We don't have any alternative way other than stopping the respond-server service to stop the logs. We should change some of the Chef configurations because it is back to default value. Here are the steps to stop the respond-server service.

1. stemctl stop rsa-nw-respond-server
2. systemctl disable rsa-nw-respond-server
3. comment out all the line in this file - /var/netwitness/config-management/cookbooks/rsa-response/recipes/install.rb, use # to comment out the line.
4. run "orchestration-cli-client --update-admin-node"

Notes

You need to perform these steps when you upgrade to next version because it would be re-enabled after every upgrade.

Product Details

RSA Product Set: NetWitness Platform
RSA Product/Service Type: Respond
RSA Version/Condition:11.3.x

Approval Reviewer Queue

RSA NetWitness Suite Approval Queue