000037029 - There are no stats for some hosts in Health & Wellness in RSA NetWitness Logs & Network

Document created by RSA Customer Support Employee on Dec 19, 2018Last modified by RSA Customer Support Employee on Jan 25, 2019
Version 2Show Document
  • View in full screen mode

Article Content

Article Number000037029
Applies ToRSA Product Set: NetWitness Logs & Network
RSA Product/Service Type: All hosts
RSA Version/Condition: 10.6.x / 11.x
 
IssueThere are no stats for some hosts in Health & Wellness.
 
CauseThe RabbitMQ federation links might not be properly configured.
 
ResolutionPlease follow these steps:
  1. SSH the affected host and run the command: 

         10.6.x:

    facter -p node_id


         11.x:


    cat /etc/salt/minion


         Take note of the node ID.
     
  2. SSH the SA/NW Server and run the command: 

    rabbitmqctl list_parameters -p /rsa/system

    Check if there are any entries with the correct node ID and IP Address of the affected host.
     
  3.  If the node ID or IP Address is not correct, then you can:
    1. Change the federation entry running these commands:       
         
        First command:

       

      rabbitmqctl -q clear_parameter -p /rsa/system federation-upstream carlos-upstream-<WRONG_NODEID>

             Example: 

       

      rabbitmqctl -q clear_parameter -p /rsa/system federation-upstream carlos-upstream-1d8aa9ec-8471-439d-87d9-9c645a0b3337

             Second command:

       

      rabbitmqctl set_parameter -p /rsa/system federation-upstream carlos-<CORRECT_NODEID> "{\"uri\": \"amqps://<CORRECT_IP>:5671?auth_mechanism=external\",\"expires\": 3600000}"

             Example: 

       

      rabbitmqctl set_parameter -p /rsa/system federation-upstream carlos-upstream-1d8aa9ec-8471-439d-87d9-9c645a0b3337 "{\"uri\": \"amqps://192.168.129.214:5671?auth_mechanism=external\",\"expires\": 3600000}"

       
  4. If the node ID and IP Address are correct, then try restarting the collect and rabbitmq services in the host: 

    service rabbitmq-server restart
    service collectd restart


     
 

Attachments

    Outcomes