RSA NetWitness Custom Feeds are not visible after a Tech Refresh

Issue

NwServer TechRefresh done and all existing feeds are missing in GUI as below.



NwServer /var/netwitness/uax/scheduler/ directory has all existing feed files.
Logdecoder /etc/netwitness/ng/feeds/ directory has all existing feed files.

Cause

This issue is due to /var/netwitness/uax/db/platform.mv.db file which overwrites the platform.h2.db database.

Resolution

Please follow the below steps to make existing feeds visible.

1. Login to NwServer ssh console as the root user.
2. Stop jetty service using the below command.
   systemctl stop jetty.service
    
3. Move the platform.mv.db file to another backup directory.
   mv var/netwitness/uax/db/platform.mv.db /root/
    
4. Start jetty service using the below command.
   systemctl start jetty.service
    
5. Login to GUI and go to Configure->Custom Feeds tab to see all existing feeds.

Product Details

RSA Product Set: RSA NetWitness Platform
RSA Product/Service Type: User Interface
RSA Version/Condition: 11.4.1.2
Platform: CentOS
O/S Version: 7

Summary

This document outlines the procedure to see all existing feeds in GUI which are invisible.

Approval Reviewer Queue

RSA NetWitness Suite Approval Queue