000032625 - Concentrator service starts without process ID in RSA Security Analytics 10.5

Document created by RSA Customer Support Employee on Jun 14, 2016Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 2Show Document
  • View in full screen mode

Article Content

Article Number000032625
Applies ToRSA Product Set: Security Analytics
RSA Product/Service Type: Concentrator
RSA Version/Condition:
Platform: CentOS
O/S Version: EL6

IssueConcentrator service starts without process ID. 
When running the start script (/usr/sbin/NwConcentrator start) the error message below is displayed.

(d) 2016-Feb-23 15:56:51 [Engine]  Using certificate file /etc/netwitness/ng/concentrator_cert.pem
(F) 2016-Feb-23 15:56:51 [Engine]  There was an error loading the certificate file /etc/netwitness/ng/concentrator_cert.pem
(F) 2016-Feb-23 15:56:51 [Engine]  Failed to start engine because std exception:use_certificate_chain_file: no start line

CauseThe cause of this problem is the appearance of file /etc/netwitness/ng/concentrator_cert.pem in the wrong directory so it has to be removed.
ResolutionTo resolve the issue, follow the steps below.
  1. Connect to the Concentrator appliance via SSH as the root user.
  2. Move the concentrator_cert.pem file to the /tmp directory as a backup.
    mv /etc/netwitness/ng/concentrator_cert.pem /tmp

  3. Restart the nwconcentrator service.
    restart nwconcentrator

If you are unsure of any of the steps above or experience any issues, contact RSA Support and quote this article number for further assistance.