|Applies To||RSA Product Set: Security Analytics|
RSA Product/Service Type: Windows Legacy Collector
RSA Version/Condition: 10.6.0.0
O/S Version: Windows 2008 R2 SP1 64-Bit
|Issue||After successfully updating 10.5.x Windows Legacy Collector to 10.6, it stopped collecting events.|
%systemDrive%\Program Files\NwLogCollector\installlog.txt shows the install was complete.
However, the following errors are seen in %systemDrive%\Netwitness\ng\logcollector\MessageBroker.log.
C:\Program Files\erl5.10.4\erts-5.10.4\bin\erlsrv: The service RabbitMQ is not an erlsrv controlled service.
The RabbitMQ service is missing from Services (services.msc).
|Cause||The issue can occur when the RabbitMQ service is removed from Services during the upgrade process.|
|Resolution||Please follow the steps below to resolve the issue.|
1. Create the RabbitMQ service manually.
sc create RabbitMQ binpath= "\"C:\Program Files\erl5.10.4\erts-5.10.4\bin\erlsrv.exe\""
2. Reinstall the legacy collector by running SALegacyWindowsCollector-10.6.<minor_version>.exe. Select the Repair option when prompted.
3. (optional) Reboot the Windows system as recommended although the collector may work without a reboot.