000033490 - Cannot expand stats option under event-broker in explore view of Virtual Log collectorin RSA Security Analytics 10.4 and above

Document created by RSA Customer Support Employee on Jul 29, 2016Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 2Show Document
  • View in full screen mode

Article Content

Article Number000033490
Applies ToRSA Product Set: Security Analytics
RSA Product/Service Type: SA Virtual Log Collector
RSA Version/Condition: 10.4 and above
IssueNot able to view local collector under config view of VLC
User-added image
Not able to view stats option under event-broker in explore view of Virtual Log collector.
User-added image
CauseLogs are not being collected and processed by Virtual Log Collector to Log Decoder.
The "puppet agent -t" command is not executing successfully and is logging the following errors because of rabbitmq permission and dependency issues.
User-added image

ResolutionFollow these steps to resolve this issue:-
1) Open an SSH session to Virtual Log Collector (VLC).
2) Stop the rabbitmq-server using below command 
#service rabbitmq-server stop

Note: Stopping the service may take a very long time so it may be necessary to kill the process using the following command:
#ps -ef | grep beam  
#kill -9 <process_id>

3) Change the permission on the subfolders and files to rabbitmq:rabbitmq from rabbitmq:root
#chown -R rabbitmq:rabbitmq /var/netwitness/logcollector/rabbitmq/

4) Start the rabbitmq-server using below command
#service rabbitmq-server start

5) Verify the changes to confirm whether it successfully executed:
#puppet agent -t