000039372 - RSA NetWitness Correlation Server Rules deployment times out due to low bandwidth

Document created by RSA Customer Support Employee on Oct 22, 2020
Version 1Show Document
  • Comment • 0
  • View in full screen mode

Article Content

Article Number000039372
Applies ToRSA Product Set: RSA NetWitness Platform
RSA Product/Service Type: Event Stream Analysis
RSA Version/Condition: 11.X
Platform: CentOS
O/S Version: 7
 
IssueWhen Correlation Rules deployed, the deployment fails with a time-out error as below.
 

On NwServer /var/lib/netwitness/uax/logs/sa.log:
2020-09-18 07:34:56,402 [pool-11-thread-1] ERROR com.rsa.smc.sa.esa.service.RuleSynchronizationService - 
Request to correlation-server.45346322-5555-4b13-9d42-640b2f10dbf2./rsa/correlation/engine/save timed out
2020-09-18 07:34:56,402 [pool-11-thread-1] ERROR com.rsa.smc.sa.esa.service.RuleSynchronizationService - 
Request to correlation-server.c1236961-e1a5-4b13-9d42-640b2f10dbf2./rsa/correlation/engine/save timed outcom.rsa.asoc.launch.api.transport.client.RequestTimeoutException: 
Request to correlation-server.c1236961-e1a5-4b13-9d42-640b2f10dbf2./rsa/correlation/engine/save timed out 
at com.rsa.asoc.launch.api.transport.client.AmqpTransportClientHelper.requestTimeoutException(AmqpTransportClientHelper.java:44) 
at com.rsa.asoc.launch.api.transport.client.AmqpTransportClient.doSendAndReceive(AmqpTransportClient.java:115) 
at com.rsa.asoc.launch.api.transport.client.AmqpTransportClient.send(AmqpTransportClient.java:69) 
at com.rsa.asoc.launch.api.transport.client.TransportClientInvocationHandler.makeRemoteCall(TransportClientInvocationHandler.java:68) 
at com.rsa.asoc.launch.api.transport.client.TransportClientInvocationHandler.invoke(TransportClientInvocationHandler.java:50) 
at com.sun.proxy.$Proxy434.save(Unknown Source) at com.rsa.smc.sa.esa.service.CorrelationServerService.deploy(CorrelationServerService.java:393) 
at com.rsa.smc.sa.esa.service.DefaultRuleSynchronizationService.synchronize(DefaultRuleSynchronizationService.java:286) 
at com.rsa.smc.sa.esa.web.controller.SynchronizationController.deploy(SynchronizationController.java:390) 
at com.rsa.smc.sa.esa.web.controller.SynchronizationController.lambda$synchronizeGroup$0(SynchronizationController.java:373) 
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) 
at java.lang.Thread.run(Thread.java:748)2020-09-18 07:34:56,403 [pool-11-thread-1] INFO  com.rsa.smc.sa.esa.service.RuleSynchronizationService - 
Synchronization Failed for 10.10.10.10 - Temp

 


 
CauseThis issue is due to low bandwidth between NwServer and Correlation Server.
Please use below document to check bandwidth between two Servers.
How to check Network bandwidth in RSA NetWitness Platform between SA/Correlation server and Data Source concentrators

Note: Above document deals checking bandwidth between ESA and Concentrator. But, same steps can be used to check bandwidth between any two CentOS servers.
ResolutionPlease communicate customer to work with internal network team to provide good bandwidth.
WorkaroundPlease follow below workaround until good bandwidth provided.
  • Please create multiple deployments.
  • Segregate rules to deploy them to separate deployments.
  • This will reduce the content to transfer between Servers and deployed successfully.

Attachments

    Outcomes