000014016 - Broker appliance becomes unlicensed without warning in RSA Security Analytics 10.3

Document created by RSA Customer Support Employee on Jun 14, 2016Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 2Show Document
  • View in full screen mode

Article Content

Article Number000014016
Applies ToRSA Security Analytics
RSA Security Analytics 10.3
RSA Security Analytics Server
RSA Security Analytics Broker
RSA Security Analytics All-in-One
Flexera FNE Server
RSA Download Central
IssueBroker appliance becomes unlicensed without warning in RSA Security Analytics 10.3.

The /var/log/messages file reports errors similar to the following:

Apr 10 19:42:52 CSO-Broker-VM-01 nw[21371]: [Engine] [failure] The module broker failed to create because: Failure in FlxDiagLicenseSourceCreateFromTrials: File seek failed.
Apr 10 19:42:52 CSO-Broker-VM-01 nw[17164]: [Flexera] [failure] Throw in function void nw::LicenseMgr::throwFlexeraError(const string&)Dynamic exception type: nw::LicenseErrorstd::exception::what: Failure in FlxDiagLicenseSourceCreateFromTrials: File seek failed.[boost::errinfo_at_line_*] = 1019
Apr 10 19:42:52 CSO-Broker-VM-01 nw[17164]: [Flexera] [failure] Failure in FlxDiagLicenseSourceCreateFromTrials: category - callout, code - 0x73000043, system - 0x0000001c, location unit - 0x4007, location hint = 1000, data - /etc/netwitness/ng/ts-1.nwl
Apr 10 19:42:52 CSO-Broker-VM-01 nw[17164]: [Flexera] [failure] Failure in FlxDiagLicenseSourceCreateFromTrials: File seek failed.
Apr 10 19:42:52 CSO-Broker-VM-01 nw[17164]: [Flexera] [failure] Throw in function void nw::LicenseMgr::throwFlexeraError(const string&)Dynamic exception type: nw::LicenseErrorstd::exception::what: Failure in FlxDiagLicenseSourceCreateFromTrials: File seek failed.[boost::errinfo_at_line_*] = 1019


The /var/log/fneserver/fne-error.log file on the Security Analytics server appliance reports errors similar to the following:

Info : [10/Apr/2014:18:57:46 +0000] Generating sync message to FNO.
Debug : [10/Apr/2014:18:58:49 +0000] HTTP Connection failed : Connection timed out.
Error : [10/Apr/2014:18:58:49 +0000] Http post error encountered by online sync to FNO: Connection timed out.
Error : [10/Apr/2014:18:58:49 +0000] Failure of online sync to FNO after 5 attempt(s). It will be repeated after 86400 seconds.

CauseThe root cause of the issue is still being investigated, but at this time is understood to be due to corruption in the license storage data on the Security Analytics server appliance.
Resolution

In order to resolve the issue, perform the workaround below.

  1. In the RSA Security Analytics UI, navigate to Administration -> Devices.
  2. Select the broker appliance that has become unlicensed and navigate to View -> Explore.
  3. In the tree, drill down to sys -> license.
  4. Right-click on license and click on Properties.
  5. In the dropdown menu in the bottom-right pane that opens, select delAll.
  6. Click the Send button.  This will delete all licensing for the broker and return the license to the pool.
  7. Connect to the Security Analytics Server appliance via SSH and issue the commands below to stop the Jetty and fneserver services.
    1. stop jettysrv
    2. service fneserver stop
  8. Connect to the broker appliance that became unlicensed via SSH and issue the commands below to restart the nwbroker service.
    1. stop nwbroker
    2. start nwbroker
  9. Return to the SSH session on the Security Analytics server appliance start the Jetty and fneserver services with the commands below.
    1. start jettysrv
    2. service fneserver start
  10. In the Security Analytics UI, return to Administration -> Devices.
  11. Select the broker that became unlicensed and click on Licenses -> Activate.

 

If the workaround above does not successfully license the broker appliance, perform the additional steps below.

  1. Log into the RSA Download Central portal and download the Offline Capability Response for the Security Analytics server in question.
  2. From the Security Analytics UI, navigate to Administration -> System, click on Licensing, and then on the Offline tab.
  3. Click on the Upload button and select the .bin file that was downloaded in Step 1.
  4. Navigate to Administration -> Devices, select the broker, and then click on Licenses -> Activate.

 

If you are unsure of any of the steps above or experience any issues, contact RSA Support and quote this article ID for further assistance.

Legacy Article IDa66384

Attachments

    Outcomes