000030390 - Reporting Engine may become blocked in RSA Security Analytics when RabbitMQ connections have a blocked state

Document created by RSA Customer Support Employee on Jun 14, 2016Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 2Show Document
  • View in full screen mode

Article Content

Article Number000030390
Applies ToRSA Product Set: Security Analytics
RSA Product/Service Type: Reporting Engine, Incident Management, Security Analytics UI, Security Analytics Server
RSA Version/Condition: 10.4.x, 10.5.x
Platform: CentOS
Platform (Other): RabbitMQ
O/S Version: EL6
IssueWhen Incident Management is enabled, if RabbitMQ connections enter a blocked state,  Reporting Engine alerts will fail and some threads will be blocked.
WorkaroundIn order to resolve the issue, Incident Management service can be stopped until the RabbitMQ connections switch back to a running state.
To stop the Incident Management service, connect to the Security Analytics server via SSH and terminate the rsa-im service using the syntax.
[root@SA-Server ~]# service rsa-im stop
Stopping RSA Security Analytics Incident Management :: Server...
Stopped RSA Security Analytics Incident Management :: Server.
[root@SA-Server ~]#

If you are unsure of any of the steps above, or experience any issues, contact RSA Support and quote this article number for further assistance.