000030579 - Health and Wellness alarms not activating after upgrade to RSA Security Analytics 10.5

Document created by RSA Customer Support Employee on Jun 14, 2016Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 2Show Document
  • View in full screen mode

Article Content

Article Number000030579
Applies ToRSA Product Set: Security Analytics
RSA Product/Service Type: Security Analytics UI, Security Analytics Server, Health and Wellness
RSA Version/Condition: 10.5.0.x, 10.5.1
Platform: CentOS
O/S Version: EL6
IssueOn the first restart of the Security Analytics UI server following an upgrade, post upgrade processing begins to migrate the hosts, services, and group information into the Host and Service groupings. Before the migration completes, the System Monitoring Service (SMS) may incorrectly exclude hosts from being associated with the Health & Wellness policy rules. 
If the host is excluded, it will not be associated with its Health & Wellness policy rules.If the host is not associated with its Health & Wellness policy rules then any alarms for that host, based on the policy rules, will not be activated.
ResolutionThis issue is being investigated by the Engineering team in order to be resolved in a future release.
WorkaroundOn 10.5.0.1, 10.5.0.2 and 10.5.1, typically restarting the rsa-sms service will trigger the alerts to fire again.
service rsa-sms restart

This can be done in production without affecting core functionality.
In addition on 10.5.0.0, after the upgrade has completed, follow these steps and note that an occasional restart of the service is required to re-trigger alerts as listed above.
  1. Log into the Security Analytics UI (if the login is successful the migration is complete).
  2. Using a secure shell program, SSH into the Security Analytics UI server as the root user.
  3. Reboot the Security Analytics UI server.
    reboot

Attachments

    Outcomes