000012777 - RSA Security Analytics Log Collector displays duplicate queues

This condition may arise because the Log Collector is not currently running or parts of the system have been shut down.

In some cases, this condition may arise because a queue consumer (such as an event processor or VLC connection) was removed outside of the normal course of operation. 

If this warning message persists and you are certain there are no legitimate consumers of these queues, you may delete them via the RSA Security Analytics UI, following the steps below.

1. Navigate to the RSA Security Analytics UI > Administration > Services.
2. Select the Log Collector device in question and navigate to View > Explore.
3. Right-click on the event-broker node in the left pane and click Properties.
4. Select delete from the drop-down menu.
5. In the parameters field, enter text similar to the following :  queue=<queueName>   (i.e. queue=LogDecoder_logdecoder_checkpoint)
        NOTE:  When entering the queue name, an underscore ( _ ) should be substituted for any periods ( . ) in the name.
6. Click the Send button and verify that a success message is displayed.
7. Repeat steps 5-6 for any additional queues that must be deleted.

If this does not solve your issue, please open a case with RSA Technical Support and reference this article so that we may better assist you.