Log Collection Legacy Windows: Troubleshoot Legacy Windows and NetApp Collection

Document created by RSA Information Design and Development on Jul 29, 2016
Version 1Show Document
  • View in full screen mode
 

This topic highlights possible problems that you may encounter with Windows Legacy Collection and suggested solutions to these problems.

Troubleshoot Legacy Windows and NetApp Collection Issues

In general, you receive more robust log messages by disabling SSL.

Errors Displayed in User Interface

                 
Problem Possible Causes Solutions

The System view displays "Appliance Service Information (Service not available)" for the Remote Collector running the log collection service for  Windows Legacy collection.
FalseErrorSysView.png

There is no Appliance Service for the Legacy Windows Collector.

Ignore this message.

The Hosts view displays "Error" in the Updates column for the Windows Legacy Remote Collector appliance.  

FalseErrorHostsView.png

The Windows Legacy collector does not use the puppet infrastructure that is part of 10.4 appliances.Ignore this message.

Protocol Restart Problems

             
ProblemPossible CausesSolutions
You restart the WIndows Legacy collection protocol, but Security Analytics is not receiving events.The logcollector service is stopped.Restart the logcollector service.
  1. Log on to the WIndows Legacy Remote Collector.
  2. Go to Start >Administrative Tools> Task Scheduler and click on Task Scheduler Library.
  3. In the right panel, look for the  restartnwlogcollector task and make sure that it is running.
  4. If this is not the case, right-click restartnwlogcollector and select Run.

Installation Problems

If you see any of the following messages in the MessageBroker.log, you may have issues. You display the MessageBroker.log from the

            
Log MessagesAny message that contains "rabbitmq"
Possible CauseRabbitMQ service may not be running.

Port 5671 may not be opened.
SolutionsMake sure that the RabbitMQ service is running.

Make sure that port 5671 is open.

 

            
Log MessagesError: Adding logcollector user account.
Error: Adding administrator tag to logcollector account.
Error: Adding Adding logcollection vhost.
Error: Setting permissions to logcollector account in all vhosts.
Error: Deleting guest account.
Possible Causerabbitmq-server was not running when installer tried to create users and vhosts.
SolutionsMake sure that the RabbitMQ service is running and run below commands manually.

rabbitmqctl -q add_user logcollector netwitness
rabbitmqctl -q set_user_tags logcollector administrator
rabbitmqctl -q add_vhost logcollection
rabbitmqctl -q set_permissions -p / logcollector ".*" ".*" ".*"
rabbitmqctl -q set_permissions -p logcollection logcollector ".*" ".*" ".*"
rabbitmqctl -q delete_user guest
You are here: Legacy Windows and NetApp Collection Configuration Guide > Troubleshoot Legacy Windows and NetApp Collection

Attachments

    Outcomes