Skip to content
  • There are no suggestions because the search field is empty.

RSA NetWitness VMware Collection stopped after 1 January 2020

Issue

VMware log collection stopped after 1 January 2020.


Cause

This was due to below VMware perl scripts that are used to collect logs have been configured with "my $defaultEndTime     = ' 2020-01-01T00:00:00Z';"

/etc/netwitness/ng/logcollection/content/collection/vmware/vmware-events/NwVmwareCollector.pl
/etc/netwitness/ng/logcollection/content/collection/vmware/vmware-tasks/NwVmwareCollector.pl

Resolution

Follow the below steps to start VMware collection back.
  1. Log in to NetWitness GUI as admin.
  2. Go to CONFIGURE->Live Content. 
  3. Search for "VMware ESX/ESXi Log Collector Configuration" and deploy it to Log Collector where VMware event sources configured.
    vm
     
  4. Log in to Log Collector putty and restart collection service using systemctl restart nwlogcollector.service command.
  5. Verify the perl scripts that are updated with the latest end time as below.
    #cat NwVmwareCollector.pl |grep -i defaulted my $defaultEndTime = '2030-01-01T00:00:00Z';
  6. Verify the VMware Logs are being collected in the Investigate page.  

Product Details

RSA Product Set: RSA NetWitness Platform
RSA Product/Service Type: Log Collector
RSA Version/Condition: 11.X
Platform: CentOS
O/S Version: 7

Summary

This document outlines the procedure to recollect vmware events which stopped after 1 January 2020.


Approval Reviewer Queue

RSA NetWitness Suite Approval Queue