000031159 - RSA Security Analytics Concentrator service becomes unavailable after 10.4.0.2 install

Document created by RSA Customer Support Employee on Jun 14, 2016Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 2Show Document
  • View in full screen mode

Article Content

Article Number000031159
Applies ToRSA Product Set: Security Analytics
RSA Product/Service Type: Security Analytics UI, Security Analytics Server, Concentrator
RSA Version/Condition: 10.4.0.2
Platform: CentOS
O/S Version: EL6
 
Issue The following issues are noticed after installing or upgrading to Security Analytics 10.4.0.2.
  •  Concentrator service becomes unmanageable from Security Analytics UI
  •  Config, System or Explore pages of the Concentrator does not show any stats or configurations
  •  Restarting the Concentrator service temporarily resolves the issue every time but the issue recurs after a while
  •  Increasing the Concentrator threads does not fix the problem
The /var/lib/netwitness/uax/logs/sa.log file shows warnings and errors similar to the example below: 
2014-12-23 11:52:41,135 [Device Polling Scheduler 1601775620] WARN  com.rsa.netwitness.carlos.clients.nextgen.nw.NwClientPipeBase - admin@X.X.X.X:56005/concentrator/stats/status received error: Message get was not recognized by /sys/stats
2014-12-23 11:52:41,199 [Device Polling Scheduler 1601775620] ERROR com.netwitness.platform.server.common.carlos.NextGenCarlosImpl - Failure checking device availability : admin@X.X.X.X:56005/concentrator/stats/status received error: Message ls was not recognized by /concentrator/stats/status; nested exception is com.rsa.netwitness.carlos.clients.nextgen.NextGenException: admin@X.X.X.X:56005/concentrator/stats/status received error: Message ls was not recognized by /concentrator/stats/status
2014-12-23 11:52:41,199 [Device Polling Scheduler 1601775620] WARN  com.rsa.smc.sa.admin.web.ui.DeviceStatusPollingTask - Failed to retrieve device status for device Concentrator
com.netwitness.platform.server.common.carlos.NextGenCarlosException: Failure checking device availability : admin@X.X.X.X:56005/concentrator/stats/status received error: Message ls was not recognized by /concentrator/stats/status; nested exception is com.rsa.netwitness.carlos.clients.nextgen.NextGenException: admin@X.X.X.X:56005/concentrator/stats/status received error: Message ls was not recognized by /concentrator/stats/status
CauseSecurity Analytics Server and the Concentrator are unable to re-establish the connection after experiencing some timeout issues for a few minutes. 
ResolutionThis issue has been permanently fixed in Security Analytics version 10.4.1 and later releases.
If you cannot upgrade to 10.4.1 or later, please contact RSA Support and quote this article number for further assistance.

Attachments

    Outcomes