Skip to content
  • There are no suggestions because the search field is empty.

Start/Stop Capture button is disabled on the Decoder service in NetWitness

Issue

The Start/Stop Capture button is disabled and the Decoder "Service Information" section is missing on the Decoder > System page within the NetWitness UI.


Cause


Failure to complete the "service?" AJAX call and load the service's license information.

Resolution

1.SSH to the admin (node zero) server to restart the License Server using the following commands
  • Column 1:
    # systemctl stop rsa-nw-license-server

    # systemctl start rsa-nw-license-server


2. Running the following command to tail the license-server.log file while restarting the license server will help indicate any further license issues that may be occurring. 
  • Column 1:
    # tail -f /var/log/netwitness/license-server/license-server.log


3. Within the NetWitness UI, navigate to the Admin -> Services -> Decoder -> View -> System page.
4. Refresh the System page.
  • The "Start/Stop Capture" button should be enabled
  • The Decoder "Service Information" section should appear, as well.

If the above steps do not work, please try the following steps:
  1. Look at one of the "appliance?" AJAX calls to see if you are seeing null values for fields such as "deviceVersion", "startDate", and/or "licenseInfo."
  2. Look through sa.log for the following error, which refers to the null values above:
    • Column 1:
      org.springframework.web.util.NestedServletException: Request processing failed; nested exception is java.lang.NullPointerException

  3. Navigate to Admin > System > Licensing to see if there are any licenses available.
  4. This issue is happening because the SA Server is unable to fetch the license information. You will need to upload a new offline response file into Admin > System > Licensing > Settings > Step 2: "Upload Offline Response File."
    • You can get the offline response file through your myRSA / Download Central account, or contact Netwitness Support to provide you with the file.
  5. Upload the offline response file into the NetWitness UI under Admin > System > Licensing > Settings Tab > Manage Local License Server Offline > "Step 2: Upload Offline Response."
  6. After you have completed the upload, go to the "Overview" tab in the same Licensing area, and refresh the licenses under Licensing Actions > Refresh Licenses.
  7. Refresh the browser window, as well, in which you are running the NetWitness UI.
  8. The licenses should now appear under Admin > System > Licensing, if they were previously missing.
  9. The "Start/Stop Capture" button should be enabled.
  10. The Decoder "Service Information" section should appear, as well.

Notes

If you open the Developer Tools > Network tab in your browser window when you are within the System page for any NetWitness core service, there are 4 AJAX calls to pay attention to:
  • service?: This corresponds to the service's "System Information." section. This will also display the service's license information.
  • user?: This corresponds to the service's "User Information" section.
  • appliance?: This corresponds to the service's "Appliance Service Information" section.
  • appliance?: This next "appliance?" request corresponds to the service's "Host User Information" section.
In this case, the system's "Service Information" section will be blank within the NetWitness UI. Within the browser's Developer Tools > service? AJAX call, it will display a "Status Code: 500 Error" because the SA Server is unable to communicate with the License Server. If there are no communication errors between the License Server and the SA Server, there may be communication issues between the service and the SA Server - look through the /var/netwitness/uax/logs/sa.log file for further information.


If this does not solve your issue, please open a case with netwitness support  and reference this article so that we may better assist you.

Product Details

Product Set: NetWitness Platform
Product/Service Type: NetWitness UI
Version/Condition: 11.x,12.x

Summary

The Start/Stop Capture button is disabled on the Decoder service


Approval Reviewer Queue

Technical approval queue