000033374 - RSA Security Analytics - Unable to add DAC to Security Analytics Warehouse (SAW) node

Document created by RSA Customer Support Employee on Jul 3, 2016Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 3Show Document
  • View in full screen mode

Article Content

Article Number000033374
Applies ToRSA Product Set: Security Analytics
RSA Product/Service Type: SA Data Warehouse
RSA Version/Condition: 10.4.X, 10.5.X, 10.6.X
 
IssueWhen DAC has to be added to SAW node, running NwArrayConfig.py script would give following errors.
In 10.4.X:
[root@WAREHOUSE4 arrayCfg]# ./NwArrayConfig.py --action add --service saw
Failed!: SAW appliances do not support extending storage.

In 10.5.X and above:
[root@WAREHOUSE4 saTools]# ./NwArrayConfig.py
Failed!: The service type mapr is not one of the services supported for external storage configuration


 
CauseThis is due to "saw" service details missing in /opt/rsa/saTools/appliance/RAID/arrayDefs.py script.
Resolution/opt/rsa/saTools/appliance/RAID/arrayDefs.py script will be updated with "saw" service details in 11.0 version.
WorkaroundPlease use follow steps for adding DAC to SAW server.
      1. Login to SAW server ssh console as administrator.
      2. In 10.5.0.0 and above versions rsa-sa-tools package available by default. However, 10.4.X version need this package installed manually.
Note: rsa-sa-tools-10.5.0.0.44-1.el6.noarch attached to this article for installing on 10.4.X version. Please upload to to SAW server using WinSCP and install using below command.

yum install rsa-sa-tools-10.5.0.0.44-1.el6.noarch


      3. Please use below command to edit arrayDefs.py file.

sa/saTools/appliance/RAID/cd  /opt/r

vi arrayDefs.py

Change below line from:
NwStrgSrvcs = ['decoder', 'logdecoder', 'concentrator', 'archiver', 'hybrid']

To:
NwStrgSrvcs = ['decoder', 'logdecoder', 'concentrator', 'archiver', 'hybrid', 'saw' ]

Also Change below section from:
# Function which returns a list of DBs and a list of services for appliance type.
def get_srvc():
    global ApplType, MySrvcLst, theDbDir, SsnRto
    MySrvcLst = []
    theDbDir = []
    theDecoder = ''
    theRslt = GetResp("/bin/rpm -qa|egrep "
                      "'(saw|mapr-emc|concentrator|(log)*decoder(10g)*|archiver|esa-server)-[0-9]'")[0].strip().split()
    theSrvcs = findall('(saw|mapr|(?:log)*decoder|concentrator|archiver|esa-server)',lst2str(theRslt))
    debug('theSrvcs: %s' % theSrvcs)
    getDcdrTyp = search('((?:log)*decoder(?:10g)*)',lst2str(theSrvcs))
    if getDcdrTyp:
        theDecoder = getDcdrTyp.group(1)
    if 'archiver' in theSrvcs:
        MySrvcLst.append('archiver')
        theDbDir.append('database')
    if 'concentrator' in theSrvcs:
        MySrvcLst.append('concentrator')
        theDbDir.append('metadb')
    if 'logdecoder' in theSrvcs or 'decoder' in theSrvcs:
        MySrvcLst.append('%s' % theDecoder)
        theDbDir.append('packetdb')
    if 'saw' in theSrvcs or 'mapr' in theSrvcs:
        MySrvcLst.append('saw')
    if len(theSrvcs) == 2 and 'concentrator' in theSrvcs and ('logdecoder' in theSrvcs or 'decoder' in theSrvcs):
        ApplType = 'hybrid'
    elif len(theSrvcs) == 1:
        ApplType = theSrvcs[0]
    else:
        ApplType = ''
    info('Service set to "%s"' % ApplType)
    return theSrvcs


To:
 
# Function which returns a list of DBs and a list of services for appliance type.
def get_srvc():
    global ApplType, MySrvcLst, theDbDir, SsnRto
    MySrvcLst = []
    theDbDir = []
    theDecoder = ''
    theRslt = GetResp("/bin/rpm -qa|egrep "
                      "'(saw|mapr-emc|concentrator|(log)*decoder(10g)*|archiver|esa-server)-[0-9]'")[0].strip().split()
    theSrvcs = findall('(saw|mapr|(?:log)*decoder|concentrator|archiver|esa-server)',lst2str(theRslt))
    debug('theSrvcs: %s' % theSrvcs)
    getDcdrTyp = search('((?:log)*decoder(?:10g)*)',lst2str(theSrvcs))
    if getDcdrTyp:
        theDecoder = getDcdrTyp.group(1)
    if 'archiver' in theSrvcs:
        MySrvcLst.append('archiver')
        theDbDir.append('database')
    if 'concentrator' in theSrvcs:
        MySrvcLst.append('concentrator')
        theDbDir.append('metadb')
    if 'logdecoder' in theSrvcs or 'decoder' in theSrvcs:
        MySrvcLst.append('%s' % theDecoder)
        theDbDir.append('packetdb')
    if 'saw' in theSrvcs or 'mapr' in theSrvcs:
        MySrvcLst.append('saw')
    if len(theSrvcs) == 2 and 'concentrator' in theSrvcs and ('logdecoder' in theSrvcs or 'decoder' in theSrvcs):
        ApplType = 'hybrid'
    elif len(theSrvcs) == 1:
        ApplType = theSrvcs[0]
        ApplType = 'saw' if ApplType == 'mapr' else ApplType
    info('Service set to "%s"' % ApplType)
    return theSrvcs

Save the file with by pressing "ESC" :wq!
      4. Run ./NwArrayConfig.py command to add the DAC.
      5. Verify lsblk command output to see new added disks from DAC addition.

Attachments

Outcomes