000029746 - The collectd service doesn't start properly after applying the Q4 '14 OS patch in RSA Security Analytics

Document created by RSA Customer Support Employee on Jun 14, 2016
Version 1Show Document
  • View in full screen mode

Article Content

Article Number000029746
Applies ToRSA Product Set: Security Analytics
RSA Product/Service Type: Security Analytics Server, Security Analytics UI, Core Appliance
RSA Version/Condition: 10.4.x
IssueOne or more of the following problems have been observed with this issue:
  • "package is not present on system" for java-1.7.0-openjdk.X86_64 is displayed when attempting to apply the Q4 update.
  • After applying the update and rebooting, collectd fails to start on the SA server, and when attempting to restart collectd from the command line, an error similar to the error below is observed:
# service collectd restart
Stopping collectd:                                         [  OK  ]
Starting collectd: ERROR: lt_dlopen ("/usr/lib64/collectd/java.so") failed: file not found. The most common cause for this problem are missing dependencies. Use ldd(1) to check the dependencies of the plugin / shared object.
                                                                     [  OK  ]

  • All appliances display "Error" in the Updates column after applying the update and rebooting.
  • A similar error is seen in the messages log after applying the update and rebooting the SA server:
collectd[2419]: lt_dlopen ("/usr/lib64/collectd/java.so") failed: file not found. The most common cause for this problem are missing dependencies. Use ldd(1) to check the dependencies of the plugin / shared object.
collectd[2419]: plugin_load: Load plugin "java" failed with status 1.
collectd[2419]: Found a configuration for the `java' plugin, but the plugin isn't loaded or didn't register a configuration callback.

 
CauseRSA included an openjava jdk in the patch bundle.
While the rpm does in fact upgrade correctly, an unresolved link to the previous version of the openjava jdk is then present in the /usr/lib64 directory, which affects collectd.
ResolutionThe issue is permanently resolved in the Q2 2015 Security Patch.


 
WorkaroundThis issue can be resolved by removing the incorrect link and recreating the link.  Follow the steps below on any host reporting the issue.
  1. SSH to the machine as the root user.
  2. Issue these commands in sequence:
    rm /usr/lib64/libjvm.so
    ln -svf /usr/lib/jvm/jre/lib/amd64/server/libjvm.so /usr/lib64/libjvm.so

  3. Restart the collectd service.
    service collectd restart

If you are unsure of any of the steps above or experience any issues, contact RSA Support and quote this article number for further assistance.
NotesIt make take upwards of 48 hours for the error to clear in the Security Analytics UI.  
While no workaround exists, this error is cosmetic in nature and can be safely ignored until the problem clears itself.  
It will not affect any type of core SA functionality, including UI functions such as investigation and reporting.

Attachments

    Outcomes