NetWitness Support has requested to have the debug logging turned on a Core service.

Issue

The debug logs will help for a deeper analysis of the issue.

Tasks

Please follow the below steps to enable debug logging.

1. Please navigate to explore page of the Service and Navigate to nodes "log" > "config".
2. Please add debug to the "log.levels" parameters.

i.e. change the value from "info,audit,warning,failure" to "info,audit,warning,failure,debug"

3. After this change, please SSH to the Netwitness Host and backup existing rsyslog.conf file using below command.

  cp /etc/rsyslog.conf /etc/rsyslog.conf.backup
 

4. Edit the file " /etc/rsyslog.conf" using vi editor to change the following line from

*.info;mail.none;authpriv.none;cron.none /var/log/messages

*.debug;*.info;mail.none;authpriv.none;cron.none /var/log/messages

5. After making the change, please save the file.

Note: Don't make any other change as it would affect operating system logging. If there is any issue observed in logging of events in /var/log/messages, please restore the file to original using backup.

6. Once the above edit is made, Please restart the rsyslog service using the below command.

 service rsyslog restart

7. This helps to enable debug logging and the failures would be clearly visible in the /var/log/messages.

Product Details

NetWitness Product Set: NetWitness Platform
NetWitness Product/Service Type: Core Appliance
NetWitness Version/Condition: 11.x, 12.x
Platform: CentOS 7 / Alma

Approval Reviewer Queue

Technical approval queue