000012777 - RSA Security Analytics Log Collector displays duplicate queues

Document created by RSA Customer Support Employee on Jun 14, 2016Last modified by RSA Customer Support on Oct 11, 2019
Version 3Show Document
  • View in full screen mode

Article Content

Article Number000012777
Applies ToRSA Product Set: Security Analytics, NetWitness Logs & Network
RSA Product/Service Type: Log Collector, RabbitMQ Message Broker
RSA Version/Condition: 10.2.x and above
Platform: CentOS 6, 7
IssueRSA Security Analytics Log Collector displays duplicate queues.
At least one queue exists that does not have any consumers.

This condition may arise because the Log Collector is not currently running or parts of the system have been shut down.

In some cases, this condition may arise because a queue consumer (such as an event processor or VLC connection) was removed outside of the normal course of operation. 


If this warning message persists and you are certain there are no legitimate consumers of these queues, you may delete them via the RSA Security Analytics UI, following the steps below.

  1. Navigate to the RSA Security Analytics UI > Administration > Services.
  2. Select the Log Collector device in question and navigate to View > Explore.
  3. Right-click on the event-broker node in the left pane and click Properties.
  4. Select delete from the drop-down menu.
  5. In the parameters field, enter text similar to the following :  queue=<queueName>   (i.e. queue=LogDecoder_logdecoder_checkpoint)
         NOTE:  When entering the queue name, an underscore ( _ ) should be substituted for any periods ( . ) in the name.
  6. Click the Send button and verify that a success message is displayed.
  7. Repeat steps 5-6 for any additional queues that must be deleted.


If this does not solve your issue, please open a case with RSA Technical Support and reference this article so that we may better assist you.

NotesAny event data stored in a queue will be lost as the result of a delete operation.

Legacy Article IDa64489