Skip to content
  • There are no suggestions because the search field is empty.

Reporting Engine appears down in the NetWitness Platform UI or is returning no results in Rules

Issue

NetWitness Reporting Engine service is down, and cannot be started.

In the NetWitness UI for Reports, Mange > Rules is not displaying any rules.

Want to reset the Reporting Engine service back to the default initial setup.

Resolution

Warning!  These steps will delete all the existing Reporting Engine rules, reports, charts and alerts.
It is recommended to export a copy of all Reporting Engine rules, reports, charts, alerts through the NetWitness UI if they are accessible.

To reset the Reporting Engine service back to the default initial setup, which deletes all existing rules, reports, charts and alerts.

  1. Connect to the NetWitness server appliance which runs the Reporting Engine service via SSH and issue the commands below to resolve the issue.

    NetWitness 11.x, 12.x

  2. Confirm there is sufficient free disk space on the mount that the /var/netwitness/re-server/rsa/soc/reporting-engine directory belongs in.  The below command will show the current disk space usage of the mount, and the disk space used by the current reporting-engine directory.
    df -hP `findmnt -n -o SOURCE --target /var/netwitness/re-server/rsa/soc/reporting-engine`
    du -sh /var/netwitness/re-server/rsa/soc/reporting-engine
  3. Rename the current reporting-engine directory as a backup.
    systemctl stop jetty
    systemctl stop rsasoc_re
    rm -rf /tmp/reporting-engine*
    mv /var/netwitness/re-server/rsa/soc/reporting-engine /var/netwitness/re-server/rsa/soc/reporting-engine.old
    systemctl start jetty
  4. After following the above commands, wait 5-10 minutes for the jetty service to fully start, and then attempt to access the NetWitness UI login page.  Once you are able to do so, return to the SSH session and issue the below two commands to complete the process.
/opt/rsa/soc/reporting-engine/bin/setup.sh
systemctl start rsasoc_re

 

If you are unsure of any of the steps above or encounter any issues, contact Netwitness Support and quote this article ID for assistance.


Internal Comments

UserName:shurtj
5/6/2014 5:00:53 PM - Reworked Article
Rewrote the article to provide additional clarification, to remove formatting issues, and to adhere to Primus best practices. Article still requires a technical review.

UserName:shurtj
8/7/2014 5:27:48 PM - Updated Article
Updated article and made changes to abide by Primus best practices in preparation for the Salesforce migration.

Product Details

Netwitness Product Set: NetWitness Platform
Netwitness Product/Service Type: Admin Server(Reporting Engine)
Netwitness Version/Condition: 11.x, 12.x or later

Summary

NetWitness Reporting Engine service is down or not displaying any Rules in the UI.


Approval Reviewer Queue

Technical approval queue