000031574 - "ERR_CONNECTION_REFUSED" is displayed when accessing the RSA Security Analytics UI

Document created by RSA Customer Support Employee on Jun 14, 2016Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 3Show Document
  • View in full screen mode

Article Content

Article Number000031574
Applies ToRSA Product Set: Security Analytics
RSA Product/Service Type: Security Analytics Server, Security Analytics UI
RSA Version/Condition: 10.4.x, 10.5.x
Platform: Software / Puppetmaster
O/S Version: CentOS 6
IssueWhen accessing the Security Analytics web UI, the browser returns "This web page is not available ERR_CONNECTION_REFUSED" as shown below.
User-added image
This issue is noticed after restarting the jettysrv service or rebooting the Security Ananlytics server host.
The /var/lib/netwitness/uax/logs/sa.log file may show APPARENT DEADLOCK!!! as shown below.
2015-10-23 00:49:17,910 [Timer-1] WARN  com.mchange.v2.async.ThreadPoolAsynchronousRunner - com.mchange.v2.async.ThreadPoolAsynchronousRunner$DeadlockDetector@6c362815 -- APPARENT DEADLOCK!!! Creating emergency threads for unassigned pending tasks!

Running puppet agent -t returns Error: Could not send report: Connection refused - connect(2) as shown in the screenshot below.
User-added image
CauseThis issue can occur when puppetmaster service is stopped or disabled.
Run the following commands to confirm the status of puppetmaster service.
1. service puppetmaster status
2. chkconfig puppetmaster --list

The following results from the above command indicate the puppetmaster service is either stopped or disabled.
1. puppet dead but subsys locked
2. puppetmaster    0:off   1:off   2:off    3:off    4:off    5:off    6:off

ResolutionTo resolve the issue, start and enable puppetmaster service, restart jettysrv and run puppet agent -t with the commands below.
1. service puppetmaster start
2. chkconfig puppetmaster on
3. restart jettysrv
4. puppet agent -t