NetWItness cannot entitle a service with a perpetual license in NetWitness

Issue

Licensing page might sometimes shows that the entitlement is a trial license, eventually expire causing the UI to display the following red banner.


/var/lib/netwitness/uax/logs/sa.log displays errors similar to below.

Cause

The issue is caused by the 'license-server' entitlement database containing an object which holds the entitlement for a service that no longer exist in NetWitness Admin server.

Resolution

Please follow the steps below to resolve the issue.

1. Log in to NetWitness UI and browse to Administration > System > Licensing > License Details.
2. SSH into the NetWitness Admin server as root.
3. Connect to the entitlement database
#mongo admin -u deploy_admin -p
>use license-server
4. Check the current entitlement status
>db.entitlement.find().pretty()

From the output, note the ObjectId for the services that appear to use trial licenses.

5. Remove the ObejectId for the missing endpoint which appears in /var/lib/netwitness/uax/logs/sa.log.
>db.entitlement.remove( { _id: ObjectId(" ") } )
e.g. >db.entitlement.remove( { _id: ObjectId("5595c9a9f28061ac50735xxx") } )

6. Repeat step #5 for all missing ObjectId.
7. Close the database.
>exit

8. From the UI (License Details Page), click on the "Refresh Licenses" button on the right hand side of the page.
9. Once the refresh process completes, confirm the services are entitled with the perpetual licenses.

Product Details

NetWitness Product Set: Security Analytics
NetWitness Product/Service Type: Security Analytics Server, Security Analytics UI
NetWitness Version/Condition: 11.x, 12x
Platform: CentOS/Alma
OS/Version: 7 8.9

Summary

An SA service appears to be entitled with a trial license. However, there is a perpetual license available for the service type. The service cannot be re-entitled with the perpetual license, and eventually expires.

Approval Reviewer Queue

Technical approval queue