000032794 - Failed to modify or delete Remote Destination from VLC in RSA Security Analytics

Document created by RSA Customer Support Employee on Jul 7, 2016•Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 3Show Document
  • Comment • 0
  • View in full screen mode

Article Content

Article Number000032794
Applies ToRSA Product Set: Security Analytics
RSA Product/Service Type: Log Collector, Virtual Log Collector
RSA Version/Condition: 10.4.x, 10.5.x
Platform: CentOS
O/S Version: 6
 
IssueAn attempt to modify or delete remote destination from VLC returns the following warming message.
 
Warning
Failed to update remote destination: Invalid or missing address: '<IP Address of LC>' 
Try adding the device to SA if not already added.


User-added image
 
CauseIt could be an issue if  VLC/LC was added to SA Server manually using username/password and is not communicating with SA through trusted connection.
Resolution1) Check LC/VLC connected to SA through trusted connection.
If using the trusted connection, Test Connection in the Add Service dialog will complete successfully with the Username and Password left blank.
2) Remove the Destination Collectors in Explore view
a. Get Destination Group name 

From the Explore view, right click on Administration->services->VLC->Explore->event-broker->config->destinations, select Properties, select List from the dropdown menu and press the Send button.

             User-added image
 
b. Find the Destination Group name and remove using the option remove

              Select remove from the dropdown menu, add name=<Destination Group name noted in a> (e.g. name=LOGDEC) to the Parameters field and press the Send button.
              User-added image   
     
 3) Add the Destination Group again
From the Log Collector's Config->Event Destinations, press the + icon under the Destination Groups pane.
       User-added image  
       User-added image

Attachments

    Outcomes