Skip to content
  • There are no suggestions because the search field is empty.

What are the options for deleting custom feeds in within the NetWitness UI

Issue

  1. What are the options for deleting custom feeds in the NetWitness UI?
  2. How to resume the Feed deleted with the "Device Only" option?
  3. How to stop the Feed from running on the Device after it has been deleted with the "Local DB Only" option?

Resolution

What are the differences between 3 options?

 

When removing custom feeds, there are 3 options to select:

  • Local DB & Device
    • The feed is deleted from both the Decoder and the Feed Database on the Admin Server. The result of this is the feed is no longer available on the UI or the Decoders. 
  • Local DB Only
    • The Feed is deleted from the Feed Database on the Admin Server only. A copy remains on the Decoders it was originally pushed to.
  • Device Only
    • The Feed remains in the Feed Database on the Admin Server, but is removed from the Decoders it was originally pushed to.

How to resume the Feed deleted with "Device Only" option?

An administrator would need to edit the feed via the UI Wizard and push it back to the Decoder services.

 

How to stop the Feed from running on the Device after deleted with "Local DB Only" option?

  • On Non CCM Managed Decoders:
    • In the UI, go to Admin>Decoder>Config>Feeds. Find the feed you want to remove, check it  and click the "-" delete button.

  • On CCM Managed Decoders:
    • Go to Configure > Policies > Policies > Your Decoder Policy> Edit> Selected Content > Find your feed and remove > and "Save and Publish" the updated policy

 


Internal Comments

UserName:shurtj
8/8/2014 3:53:31 PM - Updated Article
Updated article and made changes to abide by Primus best practices.

Jaseel K - 3 May 2024
Updated 'Applies To' and 'Categories' section.

Evan Pols - 14 Mar 2025
Rewrote from scratch and added guidance on how to remove from CCM. 


Product Details

NetWitness Product Set: NetWitness Logs & Network
 NetWitness Product/Service Type: Admin Server, Log Decoder, Packet Decoder, Live
 NetWitness Version/Condition: 11.x, 12.x 
 Platform: CentOS/Alma Linux


Approval Reviewer Queue

Technical approval queue