Skip to content
  • There are no suggestions because the search field is empty.

Unable to perform any operation on a file even as root on an RSA NetWitness Platform appliance

Issue

In an unlikely situation, you may find you are not able to perform any operation (modify, remove, move, rename etc.) on a certain file, even when logged in as root.
You would see error messages like "Operation not permitted", "Permission denied" or similar when trying to accomplish any task on the file. For example:
 
[root@nwserver ~]# rm -f example-file 
rm: cannot remove ‘example-file’: Operation not permitted

[root@nwserver ~]# echo "test" >> example-file 
-bash: example-file: Permission denied


Resolution

This issue is likely caused by the immutable attribute on the file.

You can verify this with the lsattr command. The presence of the 'i' flag in the output means the immutable attribute has been set.

Example:
[root@nwserver ~]# lsattr
---- i----------- ./example-file  <========== immutable attribute set


To remove/unset the immutable flag, use the chattr command with -i mode:
chattr -i example-file

Verify:
[root@nwserver ~]# lsattr
---------------- ./example-file <========== immutable attribute removed
 
With the immutable flag unset, you should now be able to perform the desired operation on the file.


If you are unsure of any of the steps above or experience any issues, contact  RSA Support and quote this article number for further assistance.

Product Details

RSA Product Set: NetWitness Platform
RSA Product/Service Type: All services
RSA Version/Condition: 11.X
Platform: CentOS
O/S Version: 7

Approval Reviewer Queue

RSA NetWitness Suite Approval Queue