The system hostname key is missing from the lockbox in RSA Security Analytics

Issue

The system hostname key is missing from the lockbox in NetWitness.

Errors in /var/log/messages similar to the following are displayed:

RemoteVLC nw[3780]: [EncryptionWrapper] [info] key was not found: failed to open lockbox: The system hostname key is missing from the lockbox.
RemoteVLC nw[3780]: [EncryptionWrapper] [failure] failed to open lockbox: The system hostname key is missing from the lockbox.
RemoteVLC nw[3780]: [SdeeCollection] [failure] caught exception while creating new collection configuration: failed to open lockbox: The system hostname key is missing from the lockbox

Unable to integrate any new event source with VLC.

Cause

This issue is due to virtual hardware changes on the VLC, such as being migrated to another ESXi box as part of HA or Disaster Recovery process.

Resolution

This issue can be resolved by resetting the Stable System Value, following the steps below.

1. Login to NetWitness UI with Admin access.
2. In the NetWitness UI  select Admin > Services.
3. In the Services page, select a Log Collector service.
4. In the Gear icon, select View > Config.
5. Click the Settings tab.
6. In the Lockbox Security Settings page, re-enter the lockbox password for "Reset Stable System Value" and click Apply.

If you are unsure of any of the steps above or experience any issues, contact NetWitness Support and quote this article ID for further assistance.

Notes

Refer to the knowledgebase article How to create a new Log Collector lockbox within RSA Security Analytics to reset an existing lockbox password.

Internal Comments

UserName:shurtj
8/10/2014 7:50:54 PM - Updated Article
Updated article and made changes to abide by Primus best practices.

Product Details

RSA Security Analytics
RSA Security Analytics Virtual Log Collector

Approval Reviewer Queue

Technical approval queue