000037029 - There are no stats for some hosts in Health & Wellness in RSA NetWitness Platform

Document created by RSA Customer Support Employee on Dec 19, 2018Last modified by RSA Customer Support Employee on Feb 20, 2020
Version 3Show Document
  • View in full screen mode

Article Content

Article Number000037029
Applies ToRSA Product Set: NetWitness Platform
RSA Product/Service Type: All hosts
RSA Version/Condition: 10.6.x / 11.x
 
IssueThere are no stats for some hosts in Health & Wellness.
 
Cause
The RabbitMQ federation links might not be properly configured.
ResolutionFollow these steps:
  1. SSH the affected host and run the command: 

         10.6.x:

    facter -p node_id


         11.x:


    cat /etc/salt/minion


         Take note of the node ID.
     
  2. SSH the SA/NW Server and run the command: 

    rabbitmqctl list_parameters -p /rsa/system

    Check if there are any entries with the correct node ID and IP Address of the affected host.
     
  3.  If the node ID or IP Address is not correct, then you can:
    1. Change the federation entry running these commands:       
         
        First command:

       

      rabbitmqctl -q clear_parameter -p /rsa/system federation-upstream carlos-upstream-<WRONG_NODEID>

             Example: 

       

      rabbitmqctl -q clear_parameter -p /rsa/system federation-upstream carlos-upstream-1d8aa9ec-8471-439d-87d9-9c645a0b3337

             Second command:

       

      rabbitmqctl set_parameter -p /rsa/system federation-upstream carlos-upstream-<CORRECT_NODEID> "{\"uri\": \"amqps://<CORRECT_IP>:5671?auth_mechanism=external\",\"expires\": 3600000}"

             Example: 

       

      rabbitmqctl set_parameter -p /rsa/system federation-upstream carlos-upstream-1d8aa9ec-8471-439d-87d9-9c645a0b3337 "{\"uri\": \"amqps://192.168.129.214:5671?auth_mechanism=external\",\"expires\": 3600000}"

       
  4. If the node ID and IP Address are correct, then try restarting the collect and rabbitmq services in the host: 

    service rabbitmq-server restart
    service collectd restart


  5.  Also, run rabbitmqctl list_queues -p /rsa/system to see federations created.

sample output:



Listing queues ...
federation: carlos.audit -> sa@NWAPPLIANCE4309  0
federation: carlos.esm.eventsource.changes -> sa@NWAPPLIANCE4309        0
federation: carlos.sms.collectd -> sa@NWAPPLIANCE4309   0


 


       6. Verify GUI ADMIN->Health & Wellness page to see the latest stats from problematic host.

Attachments

    Outcomes