.png?width=180&height=32&name=NW%20Logo%20(2).png){kind=small}
NetWitness appliance upgrade fails due to NFS type File System mount in 12.4 and above
Issue
NetWitness appliance upgrade fails when the system has NFS type file system mount.Sample NFS file system in the Netwitness system (Highlighted)
#df -h
Filesystem Size Used Avail Use% Mounted on
devtmpfs 63G 0 63G 0% /dev
tmpfs 63G 460K 63G 1% /dev/shm
tmpfs 63G 1.9G 61G 3% /run
tmpfs 63G 0 63G 0% /sys/fs/cgroup
/dev/mapper/netwitness_vg00-root 30G 5.0G 26G 17% /
/dev/sda1 1014M 107M 908M 11% /boot
/dev/mapper/netwitness_vg00-varlog 10G 2.1G 8.0G 21% /var/log
/dev/mapper/netwitness_vg00-nwhome 2.7T 753G 2.0T 28% /var/netwitness
/dev/mapper/netwitness_vg00-usrhome 10G 33M 10G 1% /home
/dev/mapper/archiver-database0 29T 29T 23G 100% /var/netwitness/archiver/database0
/dev/mapper/archiver1-database1 19T 16T 3.1T 84% /var/netwitness/archiver/database1
/dev/mapper/archiver2-database2 30T 27T 3.1T 90% /var/netwitness/archiver/database2
10.1.11.1:/SIEM_DR_ColdStorage_new 20T 11T 7.8T 59% /mystoragebackup
tmpfs 13G 0 13G 0% /run/user/0
Filesystem Size Used Avail Use% Mounted on
devtmpfs 63G 0 63G 0% /dev
tmpfs 63G 460K 63G 1% /dev/shm
tmpfs 63G 1.9G 61G 3% /run
tmpfs 63G 0 63G 0% /sys/fs/cgroup
/dev/mapper/netwitness_vg00-root 30G 5.0G 26G 17% /
/dev/sda1 1014M 107M 908M 11% /boot
/dev/mapper/netwitness_vg00-varlog 10G 2.1G 8.0G 21% /var/log
/dev/mapper/netwitness_vg00-nwhome 2.7T 753G 2.0T 28% /var/netwitness
/dev/mapper/netwitness_vg00-usrhome 10G 33M 10G 1% /home
/dev/mapper/archiver-database0 29T 29T 23G 100% /var/netwitness/archiver/database0
/dev/mapper/archiver1-database1 19T 16T 3.1T 84% /var/netwitness/archiver/database1
/dev/mapper/archiver2-database2 30T 27T 3.1T 90% /var/netwitness/archiver/database2
10.1.11.1:/SIEM_DR_ColdStorage_new 20T 11T 7.8T 59% /mystoragebackup
tmpfs 13G 0 13G 0% /run/user/0
Resolution
Please follow the below steps to unmount NFS mount points from the CLI.1. SSH to the NetWitness system where the NFS filesystem is mounted.
2. Stop the Netwitness service on the server that is using the NFS mount to store data.
An example for an Archiver, run the following to stop the nwarchiver service:
3. Use the following command to unmount the mount point.
# systemctl stop nwarchiver
# umount -l <dir_path>
Here,
is the path of the directory using the NFS filesystem.
Example:
# umount -l /mystoragebackup
Product Details
RSA Product Set: NetWitness PlatformRSA Product/Service Type: All nodes
RSA Version/Condition: 12.4 or later
Platform: Alma Linux
Approval Reviewer Queue
Technical approval queue