000031622 - Security Analytics Web UI becomes unavailable after 10.5.x upgrade

Document created by RSA Customer Support Employee on Sep 21, 2016Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 2Show Document
  • View in full screen mode

Article Content

Article Number000031622
Applies ToRSA Product Set: Security Analytics
RSA Product/Service Type: Security Analytics Server, Security Analytics UI, Health & Wellness
RSA Version/Condition: 10.5.x, 10.6.X
Platform: CentOS
O/S Version: EL6
IssueAfter upgrading Security Analytics server to 10.5.x, the Web UI is unavailable although the status jettysrv command shows that the service is started.
The web page shows Security Analytics server is unable to start. Please make sure all services are running and restart the Security Analytics server as shown in the following screenshot.
User-added image
The /var/lib/netwitness/uax/logs/sa.log file shows errors similar to the example below.
2015-10-29 21:07:59,221 [main] ERROR com.rsa.smc.sa.core.appliance.ApplianceMigrationService - Failed to connect to SMS service, make sure all services are running and restart SA web server.
com.rsa.smc.sa.core.util.carlos.ASGConnectionException: Failed to load hosts
2015-10-29 21:07:59,222 [main] ERROR com.rsa.smc.sa.core.appliance.ApplianceMigrationService - Failed to migrate appliances, services and groups
com.rsa.smc.sa.core.util.carlos.ASGConnectionException: Failed to load hosts

The issue remained the same after restarting the rsa-sms and jettysrv services and/or reinstalling rsa-sms-server and security-analytics-web-server RPMs.
CauseThe issue can occur when /var/netwitness is more than 80% full.
As per Task 6 in the RSA Security Analytics 10.5 Upgrade Instructions, the usage of /var/netwitness directory needs to be 80% or less.
Task 6 - Make Sure That /var/netwitness Directory Has Enough Space to Upgrade
Make sure that the usage of the /var/netwitness directory on the SA host is 80 percent or less before you upgrade.
If directory usage is greater than 80 percent, after the upgrade, the SA server host will not be running and the logs will indicate that the migration failed.

WorkaroundTo resolve the issue, perform the steps below.
  1. Move or delete files from the /var/netwitness directory to ensure its usage is 80% or less.
  2. Restart the jettysrv and rsa-sms services.
    service rsa-sms stop
    service rsa-sms start
    stop jettysrv
    start jettysrv

  3. If the issue continues, re-install the security-analytics-web-server RPM package.
    yum remove security-analytics-web-server
    yum install security-analytics-web-server

If you are unsure of any of the steps above or experience any issues, contact RSA Support and quote this article number for further assistance.