000038662 - RSA NetWitness Platform admin server instability due to overloaded RabbitMQ service

Document created by RSA Customer Support Employee on Apr 6, 2020
Version 1Show Document
  • View in full screen mode

Article Content

Article Number000038662
Applies ToRSA Product Set: NetWitness Platform
RSA Product/Service Type: NetWitness Platform/Nw Admin Server
RSA Version/Condition: 11.x
Platform: CentOS
O/S Version: EL7
IssueUnable to log into account on Admin UI
Message: The server could not be reached. Contact your system admin.

User-added image
CauseOrphaned im.saim_incident_queue could accumulate messages overtime causing overload to rabbitmq service and instability in NetWitness admin server.

From NW 11.x, the integration has changed where this message queue is no longer in used. In NW 10.x, it was used to listen to messages pushed from UCF to NetWitness.
It is advised to purge the queue periodically until appropriate changes is released in future versions.

Sample output

# rabbitmqctl list_queues -p /rsa/system messages name consumers
30094    im.saim_incident_queue    0

ResolutionRun updateCrontabWithQueuePurgeJob.sh which adds scheduled queue purging daily at 00:00

# chmod 755 updateCrontabWithQueuePurgeJob.sh
# ./updateCrontabWithQueuePurgeJob.sh
# crontab -l to verify new

If you are unsure about any of the steps above or experience any issues, contact RSA Support and quote this article ID.