NetWitness Event Analysis/Events page stuck as Loading Services due to incorrect syslog configuration

Issue

Event Analysis/Events page stays loading services as below. Drop-down could not select desired service even if target date and time are changed.



investigate-server.log:
In Node-Zero:
orchestration-cli-client -s command fails with java.lang.NullPointerException: null

Cause

This could be due to import of syslog configuration from different server and the node ID of node zero is not updating accordingly for mongo database.

Resolution

Please follow below steps to update mongo database with correct Node-zero details.

1. Login to Node-Zero and run below commands.
   mongo admin -u deploy_admin -p <password>
   use orchestration-server
   db.getCollection('service').find({ "name" : "syslog" })
   Example output:

   { "_id" : "4f738dd7073543a19ea64dcacfe67ece", "name" : "syslog", "host" : DBRef("host", "266208404d0c42cdb9e95f678e138e8d"), "port" : 514, "useTls" : false, "family" : "third-party", "meta" : { "template" : "%{timestamp}|%{deviceService}|%{deviceVendor}|%{deviceProduct}|%{deviceVersion} [audit] Event Category: %{category} Operation: %{operation} Outcome: %{outcome} Description: %{text} User: %{identity} Role: %{userRole} src=%{sourceAddress} spt=%{sourcePort} index:%{parameters} url:%{referrerUrl}", "outputType" : "rsaudp", "facility" : "AUTH" }, "_class" : "com.rsa.asoc.orchestration.service.ServiceEntity" }

   { "_id" : "53f95cd3cdc549fda2e932f9d4725ca7", "name" : "syslog", "host" : DBRef("host", "8520bbd7eee64e0aaadbd85066957f8d"), "port" : 514, "useTls" : false, "family" : "third-party", "meta" : { "template" : "%{timestamp}|%{deviceService}|%{deviceVendor}|%{deviceProduct}|%{deviceVersion} [audit] Event Category: %{category} Operation: %{operation} Outcome: %{outcome} Description: %{text} User: %{identity} Role: %{userRole} src=%{sourceAddress} spt=%{sourcePort} index:%{parameters} url:%{referrerUrl}", "outputType" : "rsaudp", "facility" : "AUTH" }, "_class" : "com.rsa.asoc.orchestration.service.ServiceEntity" }

2. Get the node-id of Node-zero by running helow command.

   cat /etc/salt/minion
   
   Example:  "0160ffae-086b-4b17-9203-3e64bbf6d95f"

3. For all the syslog configurations in point 1, run the below command:

   
   db.getCollection('service').update({"_id" : " "}, {$set: { "host" : DBRef("host", " ")}});

   Example:
   
   db.getCollection('service').update({"_id" : "4f738dd7073543a19ea64dcacfe67ece"}, {$set: { "host" : DBRef("host", "0160ffae-086b-4b17-9203-3e64bbf6d95f")}});

   
   
    

Product Details

RSA Product Set: NetWitness Logs & Network
RSA Product/Service Type: Event Stream Analysis
RSA Version/Condition: 11.3.X,11.4.X, 11.5.X

Summary

This document outlines the procedure to fix the Events page issue.

Approval Reviewer Queue

RSA NetWitness Suite Approval Queue