Skip to content
  • There are no suggestions because the search field is empty.

Start/Stop Capture button is disabled on the Decoder service in RSA NetWitness Platform version 11.3.x

Issue

The Start/Stop Capture button is disabled and the Decoder "Service Information" section is missing on the Decoder > System page within the RSA NetWitness version 11.3.x UI.


Cause

Failure to complete the "service?" AJAX call and load the service's license information.

Resolution

  1. SSH to the node zero server to restart the License Server using the following commands:
    # systemctl stop rsa-nw-license-server

    # systemctl start rsa-nw-license-server

    Running the following command to tail the license-server.log file while restarting the license server will help indicate any further license issues that may be occurring. 
    # tail -f /var/log/netwitness/license-server/license-server.log
  2. Within the RSA NetWitness UI, navigate to the Admin > Services > Decoder > View > System page.
  3. Refresh the System page.
  • The "Start/Stop Capture" button should be enabled
  • The Decoder "Service Information" section should appear, as well.
If the above steps do not work, please try the following steps:
  1. Look at one of the "appliance?" AJAX calls to see if you are seeing null values for fields such as "deviceVersion", "startDate", and/or "licenseInfo."
  2. Look through sa.log for the following error, which refers to the null values above: 
    org.springframework.web.util.NestedServletException: Request processing failed; nested exception is java.lang.NullPointerException
  3. Navigate to Admin > System > Licensing to see if there are any licenses available.
  4. This issue is happening because the SA Server is unable to fetch the license information. You will need to upload a new offline response file into Admin > System > Licensing > Settings > Step 2: "Upload Offline Response File."
    • You can get the offline response file through your myRSA / Download Central account, or contact RSA Support to provide you with the file.
  5. Upload the offline response file into the RSA NetWitness UI under Admin > System > Licensing > Settings Tab > Manage Local License Server Offline > "Step 2: Upload Offline Response."
  6. After you have completed the upload, go to the "Overview" tab in the same Licensing area, and refresh the licenses under Licensing Actions > Refresh Licenses.
  7. Refresh the browser window, as well, in which you are running the RSA NetWitness UI.
  • The licenses should now appear under Admin > System > Licensing, if they were previously missing.
  • The "Start/Stop Capture" button should be enabled.
  • The Decoder "Service Information" section should appear, as well.

Notes

If you open the Developer Tools > Network tab in your browser window when you are within the System page for any RSA NetWitness core service, there are 4 AJAX calls to pay attention to:
  • service?: This corresponds to the service's "System Information." section. This will also display the service's license information.
  • user?: This corresponds to the service's "User Information" section.
  • appliance?: This corresponds to the service's "Appliance Service Information" section.
  • appliance?: This next "appliance?" request corresponds to the service's "Host User Information" section.
In this case, the system's "Service Information" section will be blank within the RSA NetWitness UI. Within the browser's Developer Tools > service? AJAX call, it will display a "Status Code: 500 Error" because the SA Server is unable to communicate with the License Server. If there are no communication errors between the License Server and the SA Server, there may be communication issues between the service and the SA Server - look through the /var/netwitness/uax/logs/sa.log file for further information.


If this does not solve your issue, please  open a case with RSA Technical Support and reference this article so that we may better assist you.

Product Details

RSA Product Set: NetWitness Platform
RSA Product/Service Type: NetWitness UI
RSA Version/Condition: 11.3.x
Platform: CentOS
O/S Version: 7

Summary

The Start/Stop Capture button is disabled on the Decoder service in RSA NetWitness Platform version 11.3.x.


Approval Reviewer Queue

RSA NetWitness Suite Approval Queue