000032474 - Error in RSA Security Analytics 10.5.0.1: "Failed to add destination" returned while configuring Push model in VLC

Document created by RSA Customer Support Employee on Jul 6, 2016•Last modified by RSA Customer Support on Feb 8, 2018
Version 4Show Document
  • Comment • 0
  • View in full screen mode

Article Content

Article Number000032474
Applies ToRSA Product Set: Security Analytics
RSA Product/Service Type: SA Virtual Log Collector
RSA Version/Condition: 10.5.0.1
Platform: CentOS
O/S Version: 6
 
IssueDuring Virtual Log Collector (VLC) push configuration, Log Collector (LC) needs to be added as a destination in VLC->Config->Local collector tab as below.

User-added image

However, Pressing "OK" in above page would result in throwing a warning as below with the following message:
 

Failed to add destination for "CHN_VLC": "HttpOps:127.0.0.1:15671/api/nw/shovel/destinations/CHN_VLC:GET: 
Response returned with status code: 500 Response: {"error":"Internal Server Error","reason":
"{error,{exit,{noproc,{gen_server,call,\n [nw_shovel_file_server,\n {get_destination,\
"CHN_VLC\"}]}},\n [{gen_server,call,2,[{file,\"gen_server.erl\"},{line,180}]},
\n {nw_wm_shovel,get_shovel_json,2,[]},\n {nw_wm_shovel,get_json,2,[]},\n {webmachine_resource,resource_call,
3,[]},\n {webmachine_resource,do,3,[]},\n {webmachine_decision_core,resource_call,1,[]},
\n {webmachine_decision_core,decision,1,[]},\n {webmachine_decision_core,handle_request,2,[]}]}}\n"}"



 


User-added image
CauseThis 500 Response Error indicates VLC is not getting an appropriate response from Local collector within the expected time.
ResolutionPlease follow below steps to stop the warning comes up during Push configuration and to add a Log Collector as destination successfully.

1. SSH into the VLC and LC with the root account.
2. Restart the rabbitmq-server service by running the following command.

service rabbitmq-server restart


3. Test if the LC can be added.
4. If the issue continues, run reboot command from the VLC to reboot the system or also restart the collector services on both log decoder and VLC.


restart nwlogcollector


5 Wait till the VLC comes up and try configuring VLC Push configuration by navigating to VLC->Config->Local collector tab in SA GUI.

Attachments

    Outcomes