Skip to content
  • There are no suggestions because the search field is empty.

NetWitness Broker not Consuming from Concentrators/Hybrids

Issue

The Broker has stopped aggregating from the attached Concentrator service in the  Broker View -> config screen and it is falling behind. Attempts to toggle the service or to restart the aggregation have failed.

Cause

The connection between the Broker and down-stream Concentrators or Brokers needs to be re-established so that the Broker can resume aggregation.


Resolution

  1.  Login to Admin UI -> Services. 
  2. Select the Broker -> View config ->  General -> Aggregate services -> Remove the Concentrator or Broker services.
  3. SSH to the Broker appliance.
  4. Restart the nwbroker service.
  5. Use systemctl status nwbroker to ensure that the broker service is running.
# systemctl stop nwbroker
# systemctl start nwbroker
# systemctl status nwbroker
  1. Login to the Admin UI -> Services -> select the Broker -> View Config ->  General -> Aggregate services -> Add the Concentrator or Broker services back. 
  2. If this does not address the issue long term, please contact NetWitness Support for further assistance.

Notes

Removing the Concentrators will not cause any data loss, as the Broker doesn't actually contain any database files. It will take a few minutes for the Broker to re-create the indices, after which everything will back to normal.


Product Details

NetWitness Product Set: NetWitness Platform
NetWitness Product/Service Type: Broker
NetWitness Version/Condition: 11.x, 12.x
Platform: CentOS / AlmaLinux
OS Version: 7 / 8.9

Approval Reviewer Queue

Technical approval queue