000017213 - Reporting Engine can not connect to warehouse to run reports in RSA Security Analytics

Document created by RSA Customer Support Employee on Jun 15, 2016Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 2Show Document
  • View in full screen mode

Article Content

Article Number000017213
Applies ToRSA Security Analytics
RSA Security Analytics 10.3.4 and below
RSA Security Analytics 10.4.0
RSA Security Analytics Reporting Engine
RSA Security Analytics Warehouse
IssueReporting Engine can not connect to warehouse to run reports in RSA Security Analytics.
An error message similar to the following is reported:  Rule : [Windows Logon Failures SAW]  failed with error : DataSource:SAW,Failure connecting to Hive Server
CauseThis error occurs because the Security Analytics Warehouse has issues with multiple query engines connecting to it.  In this case, lucene and the reporting engine.
Resolution

In order to resolve the issue, you must go into the main SAW node through the Explore view in the Security Analytics UI and turn off the lucene search, which is in the config directory.

After making this change, reboot all SAW nodes and restart the service, which will allow the Reporting Engine to connect.

 

If you are unsure of any of the steps above or experience any issues, contact RSA Support and quote this article ID for further assistance.

Legacy Article IDa68041

Attachments

    Outcomes