000033543 - Unable to enable/disable/delete ESA rules from the UI in RSA Security Analytics

Document created by RSA Customer Support Employee on Jul 29, 2016Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 2Show Document
  • View in full screen mode

Article Content

Article Number000033543
Applies ToRSA Product Set: Security Analytics
RSA Product/Service Type: SA Event Stream Analysis
RSA Version/Condition: 10.4.x, 10.5.x, 10.6.x
IssueAfter upgrading from 10.3, some ESA rules are shown in the UI but it is not possible to enable, disable or delete the rules. When attempting to perform any of these tasks, a pop-up appears that the rule has been deleted but it is still present in the UI.  
The rules are not present in the Rule Library as well.
TasksThis occurs because in 10.3, the rules are saved under /opt/rsa/esa/modules. From 10.4 and above, this location is not used for saving the rules.
ResolutionSSH to the ESA and rename the modules directory
[root@ESA /]# service rsa-esa stop 
[root@ESA /]# mv /opt/rsa/esa/modules /opt/rsa/esa/modules.old
[root@ESA /]# service rsa-esa start