000012777 - RSA Security Analytics Log Collector displays duplicate queues

This condition may arise because the Log Collector is not currently running or parts of the system have been shut down.

In some cases this condition may arise because a queue consumer (such as an event processor or VLC connection) was removed outside of the normal course of operation. 

If this warning message persists and you are certain there are no legitimate consumers of these queues, you may delete them via the Security Analyics UI, following the steps below.

1. Navigate to Administration -> Devices.
2. Select the Log Collector device and click on View -> Explore.
3. Right-click on the event-broker node in the left pane and click Properties.
4. Select delete from the drop down menu.
5. In the parameters field, enter text similar to the following :  queue=<queueName>   (i.e. queue=LogDecoder_logdecoder_checkpoint)
        NOTE:  When entering the queue name, an underscore ( _ ) should be substituted for any periods (. ) in the name.
6. Click the Send button and verify that a success message is displayed.
7. Repeat steps 5-6 for any additional queues that must be deleted.

If you are unsure of any of the steps above or experience any issues, contact RSA Support and quote this article ID for further assistance.