000030554 - ESA rule deployment fails if the server that hosts an external database goes down in RSA Security Analytics

Document created by RSA Customer Support Employee on Jun 14, 2016•Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 3Show Document
  • Comment • 0
  • View in full screen mode

Article Content

Article Number000030554
Applies ToRSA Product Set: Security Analytics
RSA Product/Service Type: Event Stream Analysis (ESA), Security Analytics UI
RSA Version/Condition: 10.5.x, 10.6.0.0
Platform: CentOS
O/S Version: EL6
IssueNew Deployments for Rules fails with below errors when ESA has database connections configured as enrichment source.
User-added image
Errors similar to those listed below are found in the /opt/rsa/esa/logs/esa.log file.
2015-04-27 22:30:21,699 [Carlos@389e47b7-17(run(GetAvailableJdbcDrivers))(admin)] INFO com.rsa.netwitness.carlos.transport.RequestChannelListener - API Invocation Audit: identity=admin, action=GetAvailableJdbcDrivers, object=<all>, success=true

2015-04-27 22:30:24,729 [Carlos@1928841a-18(run(SetDatabaseReference))(admin)] WARN com.rsa.netwitness.core.enrichment.DatabaseReferenceManager - Connection validation for database reference "test" - success: false, details: Cannot create PoolableConnectionFactory (The connection attempt failed.) 
CauseWhen a database connection is configured to use the database as an enrichment source for a rule, a reference to the data base is deployed on every ESA even if the ESA does not deploy any rules that use the database.
If the server that hosts the database goes down, any new deployment will fail.
WorkaroundRestart the server that hosts the database.
If you are unsure of any of the steps above or experience any issues, contact RSA Support and quote this article number for further assistance.

Attachments

    Outcomes