000029731 - Unable to connect to Reporting Engine because of different IPs in RSA Security Analytics

Document created by RSA Customer Support Employee on Jun 15, 2016Last modified by RSA Customer Support Employee on Apr 22, 2017
Version 2Show Document
  • View in full screen mode

Article Content

Article Number000029731
Applies ToRSA Product Set: Security Analytics
RSA Product/Service Type: Reporting Engine
RSA Version/Condition: 10.4.x and Below
Platform: CentOS
O/S Version: 6
 
IssueThe SA WebUI is unable to connect to the Reporting Engine service on that appliance.
In this use case, the following details apply.
A Security Analytics All-In-One (AIO) for Logs physical appliance is running at IP Address 10.10.1.1.
A Security Analytics Archiver physical appliance is running at IP Address 10.10.1.2.
After changing the hostname of the AIO appliance to 127.0.0.1, it was not possible to add the Log Decoder service at 10.10.1.1 to the Archiver service at 10.10.1.2 as the AIO appliance was identified as 127.0.0.1.  
This prevents the SA WebUI from connecting to the Reporting Engine service even though the Reporting Engine service (rsasoc_re) is running. 
 
CauseThe Reporting Engine must be configured to look for the correct IPv4 address. 
Resolution

Edit the /home/rsasoc/rsa/soc/reporting-engine/conf/server.conf file and the /opt/rsa/soc/reporting-engine-10.4.0.0.<xxxx>-5/bin/reporting-engine.sh file with the changes listed below.  The <xxxx> represents the build version of the SA installation.  
1. Stop RE service using command from the ssh command line with the following command:


stop rsasoc_re

2. Open the file /home/rsasoc/rsa/soc/reporting-engine/conf/server.conf and observer the file that should look something like the following: 


RE_HOME_DIR=/home/rsasoc/rsa/soc/reporting-engine
RE_TEMP_DIR=/home/rsasoc/rsa/soc/reporting-engine/temp

3. Using vi or another editor, insert the following line as the first line of the server.conf file:
re.host=0.0.0.0

Save the file.
4. The file should then look like the following:
re.host=0.0.0.0
RE_HOME_DIR=/home/rsasoc/rsa/soc/reporting-engine
RE_TEMP_DIR=/home/rsasoc/rsa/soc/reporting-engine/temp

5. These next steps may not be necessary.
6. Review /opt/rsa/soc/reporting-engine-10.4.0.0.<xxxx>-5/bin/reporting-engine.sh for the following line:


#OTHERPARAMS="$OTHERPARAMS -Dre.host=127.0.0.1 "

In this example, the line is already commented out.  If the line is not commented out, please make that change and save the file. 

7.  Start the Reporting Engine service from the ssh command line with this command:
start rsasoc_re

8. Wait for several minutes and return to the SA WebUI.
9. Navigate to the Services page and add the Reporting Engine service to the SA WebUI with the IP Address. 

 

Attachments

    Outcomes