000031437 - All Reporting Engine rules disappear from the RSA Security Analytics UI after jetty hangs

Document created by RSA Customer Support Employee on Jun 30, 2016Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 2Show Document
  • View in full screen mode

Article Content

Article Number000031437
Applies ToRSA Product Set: Security Analytics
RSA Product/Service Type: Security Analytics Sever, Reporting Engine, Security Analytics UI
RSA Version/Condition:
IssueWhen accessing rules by navigating to Reports -> Manage -> Rules, the Security Analytics UI displays the following message:
No rules exist in the selected group

This occurs even though rules do exist. This can be tested by typing a rule name into the search bar as shown below.
User-added image

The /var/lib/netwitness/uax/logs/sa.log file displays the error message below.
2015-09-30 01:06:47,728 [qtp819238905-57658] WARN  org.atmosphere.cpr.AtmosphereResponse - Committed error code 500
2015-09-30 01:09:04,987 [qtp819238905-57653] WARN  org.atmosphere.cpr.AtmosphereResponse - Committed error code 500
2015-09-30 01:09:40,773 [qtp819238905-57663] WARN  org.atmosphere.cpr.AtmosphereResponse - Committed error code 500
2015-09-30 01:10:23,246 [qtp819238905-57663] WARN  org.atmosphere.cpr.AtmosphereResponse - Committed error code 500
CauseThis issue occurs when the jetty service is unable to retrieve the rules from Reporting Engine.
It can also occur when the jetty service hangs.
WorkaroundFollow the steps below to bring the rules back in the Security Analytics UI.
  1. Connect to the Security Analytics server via SSH as the root user.
  2. Issue the command below in sequence.
    stop jettyrv
    stop rsasoc_re
    start jettysrv

  3. Wait a moment for the service to initialize and then confirm that the Security Analytics UI is available.
  4. Issue the command below to start the Reporting Engine service.
    start rsasoc_re

  5. Navigate to Reports -> Manage -> Rules in the Security Analytics UI to confirm that the rules are once again present.
If you are unsure of any of the steps above or experience any issues, contact RSA Support and quote this article number for further assistance.