Skip to content
  • There are no suggestions because the search field is empty.

RSA NetWitness Platform 11.3 Known Issues Master List

Issue

Below is a list of known issues in RSA NetWitness Logs & Network and NetWitness Endpoint, including those listed in the Release Notes.  
Please click on the links to go directly to the articles.

General Platform
  • Column 1: Issue ID
  • Column 2: Issue Title
  • Column 3: Fix version or Status
  • Column 4: Related article


  • Column 1: SACE-11175
  • Column 2: MegaCli providing misleading disk size information for 8 TB disks on Series 6 Packet Hybrids (affects nwraidutil.pl and nwraidutil.py used by H&W)
  • Column 3: 11.3.1
  • Column 4: Internal KB, 37404

  • Column 1: SACE-11213
    ASOC-79350
  • Column 2: REST API- SAN LVS partitioning.
  • Column 3: 11.3.1
  • Column 4:


  • Column 1: SACE-11592
  • Column 2: After RMAing concentrator cannot add Powervault with SED using 11.3 nwarrycfg utility
  • Column 3: 11.3.1
  • Column 4:


General Host
  • Column 1: Issue ID
  • Column 2: Issue Title
  • Column 3: Fix version or Status
  • Column 4: Related article

  • Column 1: SACE-11406
    ASOC-77296
  • Column 2: RSA NetWitness Logs and Network 11.3 Chef run fails with "nw_pki_openssl_hashed_cert" error in chef-solo.log
  • Column 3: Under Investigation
    Workaround available
  • Column 4: https://community.rsa.com/docs/DOC-105950



General UI
  • Column 1: Issue ID
  • Column 2: Issue Title
  • Column 3: Fix version or Status
  • Column 4: Related article

  • Column 1: SACE-11539
  • Column 2: Unable to delete dashboards and charts created by deleted users
  • Column 3: Awaiting QE Test
  • Column 4:


Security
  • Column 1: Issue ID
  • Column 2: Issue Title
  • Column 3: Fix version or Status
  • Column 4: Related article

  • Column 1: SACE-11287
  • Column 2: Security Vulnerabilities on Host OS
  • Column 3: 11.4
  • Column 4:

  • Column 1: ASOC-75957
  • Column 2: Python Security Update https://access.redhat.com/errata/RHSA-2019:0710.
  • Column 3: 11.3.1
  • Column 4:


Core Services
  • Column 1: Issue ID
  • Column 2: Issue Title
  • Column 3: Fix version or Status
  • Column 4: Related article

  • Column 1: SACE-11468
  • Column 2: Decoder Crash due to Core Files post upgrade to NW 11.3
  • Column 3: 11.3.1
  • Column 4:

  • Column 1: SACE-11554
  • Column 2: Unable to export app rules in NW 11
  • Column 3: 11.4
  • Column 4:

  • Column 1: ASOC-75007
  • Column 2: Previously, if the Log Decoder was sent bad data that appeared to consist of a certain number of bytes, but the message contained fewer bytes, the Log Decoder waited indefinitely for data that never arrived. The number of bytes allowed for length-prefixed transmissions is now limited to address this issue.
  • Column 3: 11.3.1
  • Column 4:

  • Column 1: SACE-12047
  • Column 2: nwbroker.service is unable to start in NW 11.3.1
  • Column 3: 11.3.1 HF
  • Column 4:

  • Column 1: SACE-11110
  • Column 2: Upgrade 11.2.0.1 issue WebUI
  • Column 3: 11.3
  • Column 4:

  • Column 1: SACE-11737
  • Column 2: UI getting the "Invalid CSRF Token was found on the request parameter 'ctoken' or header 'ctoken'" error
  • Column 3: 11.4
  • Column 4:

  • Column 1: SACE-12068
  • Column 2: NW 11.3.1.0: Network decoder and concentrator missing some 'Physical Drives' and all 'Logical Drives' in Service Stats page
  • Column 3: 11.3.2
  • Column 4:

  • Column 1: SACE-11762
  • Column 2: NW 11.3: UI becomes unresponsive and you must kill the page via chrome until jetty restart
  • Column 3: 11.3.1.1
  • Column 4:

  • Column 1: SACE-11917
  • Column 2: Clone for another customer: NW 11.3: UI becomes unresponsive and you must kill the page via chrome until jetty restart
  • Column 3: 11.3.1.1
  • Column 4:

  • Column 1: SACE-11064
  • Column 2: Snapshots of rules applied to a Decoder service are not generated in NW v11.2
  • Column 3: 11.4
  • Column 4:

  • Column 1: SACE-11837
  • Column 2: Archiver's Collection is filling with all the logs
  • Column 3: 11.3.1.1
  • Column 4:

  • Column 1: SACE-11837
  • Column 2: Archiver collection stores more data than expected
  • Column 3: 11.3.1.1
  • Column 4:


Log Collector
  • Column 1: Issue ID
  • Column 2: Issue Title
  • Column 3: Fix version or Status
  • Column 4: Related article

  • Column 1: SACE-11434
    ASOC-78604
  • Column 2: Office365 plugin issue with disabled SSL
  • Column 3: Fix in progress
  • Column 4:


ESA
  • Column 1: Issue ID
  • Column 2: Issue Title
  • Column 3: Fix version or Status
  • Column 4: Related article

  • Column 1: SACE-10542
    SMC-15477
  • Column 2: ESA falls behind when User Baseline is enabled
  • Column 3: Awaiting content  update
  • Column 4:

  • Column 1: SACE-11407
    ASOC-77776
  • Column 2: ESA Alert time stamp mismatch post migration
  • Column 3: Fix in progress
  • Column 4:

  • Column 1: SACE-11449
  • Column 2: Existing ESA Rule Builder rules that contain array fields won't deploy after upgrading to NW 11.3
  • Column 3: 11.3.1
  • Column 4:

  • Column 1: SACE-11542
    ASOC-80165
  • Column 2: Event type "Correlation" in the Event Analysis page cannot be retrieved
  • Column 3: Fix in progress
  • Column 4:

  • Column 1: SACE-11561
  • Column 2: rsa-nw-esa-server was started after upgrade to 11.3 (causing issues with esa alerts)
  • Column 3: 11.3.1
  • Column 4:

  • Column 1: SACE-11668
    ASOC-79640
  • Column 2: disabled rules Getting re-enabled after deploy and esa correlation service restart
  • Column 3: 11.3.1
  • Column 4:

  • Column 1: SACE-11755
  • Column 2: After upgrade from 10.6.6 > 11.3, jetty is unable to load or manage ESA deployments
  • Column 3: 11.3.0 HF
    11.3.1.0 may have the issue
  • Column 4:

  • Column 1: SACE-11768
  • Column 2: NW 11.3.0 - ESA alerts not triggering after fixing issues under SACE-11444
  • Column 3: Under Investigation
  • Column 4:

  • Column 1: SACE-11782
  • Column 2: Unable to edit Correlation-server data source attributes (pw/compression/ssl) without removing and readding datasource
  • Column 3: 11.3.0 HF
  • Column 4:

  • Column 1: SACE-11856
  • Column 2: ESA UI should provide capability to manage Correlation-server->Stream->lowercase meta keys and use them in ESA Rules
  • Column 3: 11.3.0.2
  • Column 4:

  • Column 1: SACE-11938
  • Column 2: ESA Correlation Server in Unhealthy State
  • Column 3: 11.3.0.2
    11.3.2
  • Column 4:

  • Column 1: SACE-11944
  • Column 2: ESA Rule Builder Description field getti