000033857 - Alerts page showing "Content store is offline" in RSA Security Analytics 10.6.1

Document created by RSA Customer Support Employee on Aug 24, 2016Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 4Show Document
  • View in full screen mode

Article Content

Article Number000033857
Applies To
RSA Product Set: NetWitness Logs and Packets, Security Analytics
RSA Product/Service Type: Head Unit, User Interface
RSA Version/Condition: 10.6.1
Platform: CentOS
IssueWhen navigating to Alerts ------> Configure  a blank page is seen with the error message "content store is offline" and the ESA rules can't be viewed or deployed. 
User-added image
CauseThe tokumx service on the Security Analytics head unit is dead and a pid file exists.
ResolutionThe resolve the issue, follow the steps below.
  1. SSH to the NetWitness head unit and locate tokumx.pid
  2. Delete the tokumx.pid file
  3. Restart the tokumx service