Netwitness Recurring feed CSV file is failed to access.

Issue

The CSV file placed in Admin Server /var/netwitness/common/repo/ directory and Recurring feed URL failed to connect with the below errors.

/var/lib/netwitness/uax/logs/sa.log:

 2022-01-11 06:19:42,433 [qtp527446182-397346] ERROR com.rsa.smc.sa.core.service.DefaultHttpClientService - https://netwitness/nwrpmrepo/mytest.csv
 
java.net.UnknownHostException: 
 netwitness: Name or service not known
 
 at java.base/java.net.Inet6AddressImpl.lookupAllHostAddr(Native Method)
 
 at java.base/java.net.InetAddress$PlatformNameService.lookupAllHostAddr(InetAddress.java:929)
 
 at java.base/java.net.InetAddress.getAddressesFromNameService(InetAddress.java:1515)
 
 at java.base/java.net.InetAddress$NameServiceAddresses.get(InetAddress.java:848)
 
 at java.base/java.net.InetAddress.getAllByName0(InetAddress.java:1505)
 
 at java.base/java.net.InetAddress.getAllByName(InetAddress.java:1364)
 
 at java.base/java.net.InetAddress.getAllByName(InetAddress.java:1298)
 
 at org.apache.http.impl.conn.SystemDefaultDnsResolver.resolve(SystemDefaultDnsResolver.java:45)

Cause

This issue is due to DNS issues.

Resolution

Please follow the below steps to connect the Recurring feed URL.

1. SSH to the Admin Server.
2. Edit /etc/hosts file to mention the mapping against the Admin Server IP to specify the domain as netwitness. The mapping entry will look as below and 10.X.X.X is AdminServer IP.

 10.X.X.X netwitness

3. Restart jetty service using below command.

systemctl restart jetty

Note: GUI will be offline for <5 minutes.

After following these steps, The URL https://netwitness/nwrpmrepo/mytest.csv connects successfully.

If this custom entry in /etc/hosts file is to be permanent, please make this entry in /etc/hosts.user file and run the below command to reflect the change as documented in https://community.netwitness.com/t5/netwitness-platform-online/manage-custom-host-entries/ta-p/669805.

nw-manage --refresh-host --host-key

Product Details

RSA Product Set: RSA NetWitness Logs & Network
RSA Product/Service Type: Security Analytics Server
RSA Version/Condition: 11.X
Platform: CentOS
O/S Version: 7

Summary

This document outlines the procedure to access the custom feed csv file placed in AdminServer.

Approval Reviewer Queue

Technical approval queue