NetWitness Platform - Aggregation on Archiver Cannot Be Started

Issue

After adding External storage (ex.Powervault) to Archiver and when trying to start aggregation, the aggregation does not start and the aggregation button lights up again.

Cause

The sequence of the settings for meta.dir, packet.dir and session.dir is incorrect under explore mode of Archiver (/database/config)

The correct sequence should be database0 followed by database1 and so on.

Example:

Incorrect

Correct

Resolution

Access the explore mode of the Archiver and navigate to "database/config" and change the sequence of the settings for meta.dir , packet.dir and session.dir

Incorrect settings:

meta.dir:

packet.dir

session.dir

Correct Setting

meta.dir

packet.dir

session.dir

Notes

From /var/log/message, when starting aggregation, the following error can be seen:

There is not enough free space (12.06GB) on volume for /var/netwitness/archiver/database0/default/packetdb to continue writing data reliably

Product Details

NetWitness Product Set: NetWitness Platform
NetWitness Product/Service Type:  Archiver
NetWitness Version/Condition: 11.x , 12.x
Platform: CentOS, AlmaLinux
 

Approval Reviewer Queue

Technical approval queue