000033729 - Fix Permissions for Tokumx database on Security Analytics

Document created by RSA Customer Support Employee on Aug 9, 2016Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 2Show Document
  • View in full screen mode

Article Content

Article Number000033729
Applies ToRSA Product Set: RSA Security Analytics
RSA Product/Service Type: All Security Analytics Nodes
RSA Version/Condition: 10.4 or higher
  • Can not start tokumx service

  • [root@Hybrid /]# service tokumx restart
    Stopping tokumx:                                           [FAILED]
    Error disabling transparent_hugepages, are you running in a linux container?
    If the server fails to start, check that transparent hugepages are disabled.
    Starting tokumx:                                           [FAILED]

  • In the /var/log/tokumx/tokumx.log shows the errors below

  • Tue Aug  9 09:38:16.439 [initandlisten] options: { command: [ "run" ], config: "/etc/tokumx.conf", dbpath: "/var/netwitness/database/tokumx", fork: "true", logappend: "true", logpath: "/var/log/tokumx/tokumx.log", pidfilepath: "/var/run/tokumx/tokumx.pid", pluginsDir: "/usr/lib64/tokumx/plugins", quiet: true }
    Tue Aug  9 09:38:16.439 [initandlisten] exception in initAndListen: 10309 Unable to create/open lock file: /var/netwitness/database/tokumx/mongod.lock errno:13 Permission denied Is a mongod instance already running?, terminating
    Tue Aug  9 09:38:16.439 dbexit:
    Tue Aug  9 09:38:16.439 [initandlisten] shutdown: going to close listening sockets...
    Tue Aug  9 09:38:16.440 [initandlisten] shutdown: going to flush diaglog...
    Tue Aug  9 09:38:16.440 [initandlisten] shutdown: going to close sockets...
    Tue Aug  9 09:38:16.440 [initandlisten] shutdown: going to close databases...
    Tue Aug  9 09:38:16.440 [initandlisten] shutdown: going to unload all plugins...
    Tue Aug  9 09:38:16.440 [initandlisten] shutdown: going to shutdown TokuMX...
    Tue Aug  9 09:38:16.440 [initandlisten] [tokumx] shutdown
    Tue Aug  9 09:38:16.440 [initandlisten] shutdown: removing fs lock...
    Tue Aug  9 09:38:16.440 [initandlisten] couldn't remove fs lock errno:9 Bad file descriptor
    Tue Aug  9 09:38:16.440 dbexit: really exiting now
    Tue Aug  9 09:53:39.276  nssize is a deprecated parameter
    forked process: 14696
    all output going to: /var/log/tokumx/tokumx.log

  • This is caused due to lack of permissions for the user "tokumx" on the directory /var/netwitness/database/tokumx/ , hence can not create a lock file.
  • Ownership of this directory should be set to "tokumx" user.
  • The resolution is to either give read/write access to group others on this directory or to change ownership of this directory to tokumx user. better start with ownership.

  • [root@Hybrid /]# chown -R tokumx:tokumx /var/netwitness/database/tokumx

NotesIf you are unsure of these steps, please contact RSA support and reference this article.