000012777 - RSA Security Analytics Log Collector displays duplicate queues

Document created by RSA Customer Support Employee on Jun 14, 2016Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 2Show Document
  • View in full screen mode

Article Content

Article Number000012777
Applies ToRSA Security Analytics
RSA Security Analytics Log Collector
RabbitMQ Message Broker 10.2.x and above
IssueRSA Security Analytics Log Collector displays duplicate queues.
At least one queue exists that does not have any consumers.
Cause

This condition may arise because the Log Collector is not currently running or parts of the system have been shut down.


In some cases this condition may arise because a queue consumer (such as an event processor or VLC connection) was removed outside of the normal course of operation. 

Resolution

If this warning message persists and you are certain there are no legitimate consumers of these queues, you may delete them via the Security Analyics UI, following the steps below.


  1. Navigate to Administration -> Devices.
  2. Select the Log Collector device and click on View -> Explore.
  3. Right-click on the event-broker node in the left pane and click Properties.
  4. Select delete from the drop down menu.
  5. In the parameters field, enter text similar to the following :  queue=<queueName>   (i.e. queue=LogDecoder_logdecoder_checkpoint)
         NOTE:  When entering the queue name, an underscore ( _ ) should be substituted for any periods (. ) in the name.
  6. Click the Send button and verify that a success message is displayed.
  7. Repeat steps 5-6 for any additional queues that must be deleted.

 


If you are unsure of any of the steps above or experience any issues, contact RSA Support and quote this article ID for further assistance.

NotesAny event data stored in a queue will be lost as the result of a delete operation.
Legacy Article IDa64489

Attachments

    Outcomes