000031921 - Error message "An error occurred creating an AMQP Channel" from collectd in RSA Security Analytics 10.4.1 and above

Document created by RSA Customer Support Employee on Jun 14, 2016•Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 3Show Document
  • Comment • 0
  • View in full screen mode

Article Content

Article Number000031921
Applies ToRSA Product Set: Security Analytics
RSA Product/Service Type: Decoder, Log Decoder, Concentrator, Hybrid, Broker, Security Analytics Server
RSA Version/Condition: 10.4.1.x, 10.5.x
Platform: CentOS
Platform (Other): collectd
O/S Version: EL5 / EL6
 
IssueAn error similar to that shown below appears in /var/log/messages on the Security Analytics Server or Core Appliance.
While these errors are benign, there are many of them, making it difficult to sort what is an actual failure and what is not a failure in collectd.
 
Mar 29 18:35:38 sa-server collectd[32133]: An error occurred publishing a statistic for plugin c21188e2-b261-456f-8cd7-a1ea902925f5/sa_processinfo-string-service_status. Error: An error occurred publishing an AMQP Message. Exchange name: carlos.sms.collectd; error: An error occurred creating an AMQP Channel. Configuration: {#012 "urn": "carlos.sms.collectd",#012 "connection":#012
{#012 "vhost": "\/rsa\/system"#012 }


 
CauseThis issue has been identified as incorrectly spelled plugin names in the /etc/puppet/modules/rabbitmq/manifests/init.pp configuration file.
ResolutionBefore beginning, download the init.pp file provided in the attachments section of this article and scp the file to the SA server.  This configuration file is managed by puppet, and propagated to each core device from the SA server.  This example uses the /tmp directory as the initial scp location for the new init.pp file.  These commands are to be run from an ssh terminal window using the root credentials.
To resolve the issue, follow the steps below.
  1. On the SA server, make a backup copy of the existing  /etc/puppet/modules/rabbitmq/manifests  file.
    cd  /etc/puppet/modules/rabbitmq/manifests
    cp init.pp /root/init.pp.orig.<todaysDate>

  2. Replace the current init.pp file in /etc/puppet/modules/rabbitmq/manifests with the new file from this article.
    cp /tmp/init.pp /etc/puppet/modules/rabbitmq/manifests/init.pp

    Note: You will be prompted to overwrite the existing file and must say yes to this prompt.
  3. On the SA server, restart the puppetmaster process.
    service puppetmaster restart

  4. On the SA server, restart the puppet process.
    service puppet restart

  5. On the SA server, restart the rabbitmq process.
    service rabbitmq-server restart

  6. On every affected core device communicating with the SA server, (concentrators and decoders), run the following command to propagate the new init.pp file to the device.
    puppet agent –t

If you are unsure of any of the steps above or experience any issues, contact RSA Support and quote this article number for further assistance.

Attachments

Outcomes