000030589 - Renaming the Log Collector or Log Decoder hostname is not reflected on the Event Sources Manage page in RSA Security Analytics

Document created by RSA Customer Support Employee on Jun 14, 2016Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 3Show Document
  • View in full screen mode

Article Content

Article Number000030589
Applies ToRSA Product Set: Security Analytics
RSA Product/Service Type: Log Decoder, Log Collector, Security Analytics UI, Security Analytics Server
RSA Version/Condition: 10.5.x, 10.6.0.0
Platform: CentOS
O/S Version: EL6
IssueOn the Administration -> Hosts page in the Security Analytics UI, if you edit the Log Collector or Log Decoder appliance name, then the change will not be reflected on the Administration -> Event Sources -> Manage page in the Log Collector or Log Decoder columns.
User-added image
ResolutionThis issue is currently being investigated by the Engineering team in order for it to be resolved in a future release.
WorkaroundOnce you update a host name from the Administration -> Hosts page, the following steps must be performed:
  1. Connect to the Security Analytics Server appliance via SSH as the root user.
  2. Restart the SMS service by issuing the following command:  service rsa-sms restart
  3. In the Security Analytics UI, wait for the Administration -> Event Sources -> Manage page to come back up.
  4. On that page, delete the event sources with the old Log Collector or Log Decoder names.
If you are collecting events from deleted event sources, then they will be automatically added back to the Administration -> Event Sources -> Manage page with the new Log Collector or Log Decoder name.
If you are unsure of any of the steps above or experience any issues, contact RSA Support and quote this article number for further assistance.

Attachments

    Outcomes