|Applies To||RSA Product Set: Security Analytics|
RSA Product/Service Type: Reporting Engine
RSA Version/Condition: 10.4.x and Below
O/S Version: 6
|Issue||The SA WebUI is unable to connect to the Reporting Engine service on that appliance.|
In this use case, the following details apply.
A Security Analytics All-In-One (AIO) for Logs physical appliance is running at IP Address 10.10.1.1.
A Security Analytics Archiver physical appliance is running at IP Address 10.10.1.2.
After changing the hostname of the AIO appliance to 127.0.0.1, it was not possible to add the Log Decoder service at 10.10.1.1 to the Archiver service at 10.10.1.2 as the AIO appliance was identified as 127.0.0.1.
This prevents the SA WebUI from connecting to the Reporting Engine service even though the Reporting Engine service (rsasoc_re) is running.
|Cause||The Reporting Engine must be configured to look for the correct IPv4 address.|
Edit the /home/rsasoc/rsa/soc/reporting-engine/conf/server.conf file and the /opt/rsa/soc/reporting-engine-10.4.0.0.<xxxx>-5/bin/reporting-engine.sh file with the changes listed below. The <xxxx> represents the build version of the SA installation.
2. Open the file /home/rsasoc/rsa/soc/reporting-engine/conf/server.conf and observer the file that should look something like the following:
3. Using vi or another editor, insert the following line as the first line of the server.conf file:
Save the file.
4. The file should then look like the following:
5. These next steps may not be necessary.
#OTHERPARAMS="$OTHERPARAMS -Dre.host=127.0.0.1 "
In this example, the line is already commented out. If the line is not commented out, please make that change and save the file.
7. Start the Reporting Engine service from the ssh command line with this command: