|Applies To||RSA Security Analytics|
RSA Security Analytics 10.3.4 and below
RSA Security Analytics 10.4.0
RSA Security Analytics Reporting Engine
RSA Security Analytics Warehouse
|Issue||Reporting Engine can not connect to warehouse to run reports in RSA Security Analytics.|
An error message similar to the following is reported: Rule : [Windows Logon Failures SAW] failed with error : DataSource:SAW,Failure connecting to Hive Server
|Cause||This error occurs because the Security Analytics Warehouse has issues with multiple query engines connecting to it. In this case, lucene and the reporting engine.|
In order to resolve the issue, you must go into the main SAW node through the Explore view in the Security Analytics UI and turn off the lucene search, which is in the config directory.
After making this change, reboot all SAW nodes and restart the service, which will allow the Reporting Engine to connect.
If you are unsure of any of the steps above or experience any issues, contact RSA Support and quote this article ID for further assistance.
|Legacy Article ID||a68041|