000037029 - There are no stats for some hosts in Health & Wellness in RSA NetWitness Platform

Document created by RSA Customer Support Employee on Dec 19, 2018Last modified by RSA Customer Support Employee on Apr 16, 2020
Version 4Show Document
  • View in full screen mode

Article Content

Article Number000037029
Applies ToRSA Product Set: NetWitness Platform
RSA Product/Service Type: All hosts
RSA Version/Condition: 10.6.x / 11.x
IssueThere are no stats for some hosts in Health & Wellness.
The RabbitMQ federation links might not be properly configured.
ResolutionFollow these steps:
  1. SSH the affected host and run the command: 


    facter -p node_id


    cat /etc/salt/minion

         Take note of the node ID.
  2. SSH the SA/NW Server and run the command: 

    rabbitmqctl list_parameters -p /rsa/system

    Check if there are any entries with the correct node ID and IP Address of the affected host.
  3.  If the node ID or IP Address is not correct, then you can:
    1. Change the federation entry running these commands:       
        First command:


      rabbitmqctl -q clear_parameter -p /rsa/system federation-upstream carlos-upstream-<WRONG_NODEID>



      rabbitmqctl -q clear_parameter -p /rsa/system federation-upstream carlos-upstream-1d8aa9ec-8471-439d-87d9-9c645a0b3337

             Second command:


      rabbitmqctl set_parameter -p /rsa/system federation-upstream carlos-upstream-<CORRECT_NODEID> "{\"uri\": \"amqps://<CORRECT_IP>:5671?auth_mechanism=external\",\"expires\": 3600000}"



      rabbitmqctl set_parameter -p /rsa/system federation-upstream carlos-upstream-1d8aa9ec-8471-439d-87d9-9c645a0b3337 "{\"uri\": \"amqps://\",\"expires\": 3600000}"

  4. If the node ID and IP Address are correct, then try restarting the collect and rabbitmq services in the host: 

    service rabbitmq-server restart
    service collectd restart

  5.  Also, run rabbitmqctl list_queues -p /rsa/system to see federations created.

sample output:

Listing queues ...
federation: carlos.audit -> sa@NWAPPLIANCE4309  0
federation: carlos.esm.eventsource.changes -> sa@NWAPPLIANCE4309        0
federation: carlos.sms.collectd -> sa@NWAPPLIANCE4309   0


       6. Verify GUI ADMIN->Health & Wellness page to see the latest stats from problematic host.
NotesIf the following command shows some/all queues missing on the host, please follow the steps below to resolve the issue.

rabbitmqctl list_queues -p /rsa/system

  1. Note the NODEID from the affected host.

    cat /etc/salt/minion

  2. Clear parameter of the host from the Admin Server.
    SSH to the Admin server.

    rabbitmqctl list_parameters -p /rsa/system  (confirm the entry)
    rabbitmqctl -q clear_parameter -p /rsa/system federation-upstream carlos-upstream-<NODEID>  (run this command even if the current entry appears with the correct NODEID and IP of the host.)

  3. Remove and re-add the host.
    SSH to the Admin server.

    orchestration-cli-client --remove-key <NODEID>
    orchestration-cli-client --accept-key <NODEID>
    orchestration-cli-client -i -o <NODEID> -c <Category_Name> -b <IP_AdminServer>  (refer to https://community.rsa.com/docs/DOC-84671)

  4. Confirm the status from the host.

    rabbitmqctl list_queues -p /rsa/system

    The following is an example of an expected results.

    # rabbitmqctl list_queues -p /rsa/system
    Listing queues
    federation: carlos.audit -> rabbit@NWSRV       0
    federation: carlos.alerts -> rabbit@NWSRV      0
    federation: carlos.sms.collectd -> rabbit@NWSRV        0
    federation: carlos.esm.eventsource.changes -> rabbit@NWSRV     0