000032676 - Failed to discover new hosts seen in sa.log file after editing the /etc/puppet/modules/rabbitmq/files/truststore.pem in RSA NetWitness

Document created by RSA Customer Support Employee on Jun 14, 2016Last modified by RSA Customer Support on Apr 17, 2019
Version 3Show Document
  • View in full screen mode

Article Content

Article Number000032676
Applies ToRSA Product Set: NetWitness Logs and Packets (Security Analytics)
RSA Product/Service Type: NetWitness Server
RSA Version/Condition: 10.5.x, 10.6.x
Platform: CentOS
O/S Version: 6
 
IssueFailed to discover new hosts seen in /var/lib/netwitness/uax/logs/sa.log file after editing the /etc/puppet/modules/rabbitmq/files/truststore.pem

The messages will look similar to:
 

2016-02-22 14:37:20,540 [taskScheduler-7] ERROR com.rsa.smc.sa.admin.service.DefaultPuppetService - Failed to discover new hosts
com.rsa.smc.sa.admin.exception.PuppetException: Failed to discover new hosts
at com.rsa.smc.sa.admin.service.DefaultPuppetService.refreshCertificateList(DefaultPuppetService.java:144)
at com.rsa.smc.sa.admin.service.DefaultPuppetService.scheduleRefreshCertificateList(DefaultPuppetService.java:104)
at sun.reflect.GeneratedMethodAccessor1170.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:497)
at org.springframework.scheduling.support.ScheduledMethodRunnable.run(ScheduledMethodRunnable.java:64)
at org.springframework.scheduling.support.DelegatingErrorHandlingRunnable.run(DelegatingErrorHandlingRunnable.java:53)
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
at java.util.concurrent.FutureTask.runAndReset(FutureTask.java:308)
at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$301(ScheduledThreadPoolExecutor.java:180)
at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:294)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
at java.lang.Thread.run(Thread.java:745)
Caused by: com.rsa.smc.sa.admin.exception.MCOAgentException:
at com.rsa.smc.sa.admin.management.mcollective.AbstractMCOAgent.execute(AbstractMCOAgent.java:72)
at com.rsa.smc.sa.admin.management.mcollective.AbstractMCOAgent.executeAndReturnSingle(AbstractMCOAgent.java:89)
at com.rsa.smc.sa.admin.service.DefaultPuppetService.refreshCertificateList(DefaultPuppetService.java:128)
... 13 more
Caused by: org.apache.commons.exec.ExecuteException: Process exited with an error: 1 (Exit value: 1)
at org.apache.commons.exec.DefaultExecutor.executeInternal(DefaultExecutor.java:404)
at org.apache.commons.exec.DefaultExecutor.access$200(DefaultExecutor.java:48)
at org.apache.commons.exec.DefaultExecutor$1.run(DefaultExecutor.java:200)
... 1 more


Running the command mco ping will also return no results.
The file /etc/puppet/modules/rabbitmq/files/truststore.pem was recently updated, perhaps for an integration with RSA Security Operations Module (SecOps) in Archer.

 
ResolutionCheck that there are no DOS line endings at the end of the certificate.

vi /etc/puppet/modules/rabbitmq/files/truststore.pem


and remove the ^M character from any lines.

After doing this run the command below. 

puppet agent -t
NotesDOS formatted files can also be converted to Unix format by running :set ff=unix in vi.

Attachments

    Outcomes