000034832 - VC REVIEW 20191113 "Could not load content. Service is unreachable." error  on ESA with All-in-one appliance in RSA NetWitness

Document created by RSA Customer Support Employee on Mar 16, 2017•Last modified by RSA Customer Support on Sep 15, 2020
Version 4Show Document
  • Comment • 0
  • View in full screen mode

Article Content

Article Number000034832
Applies ToRSA Product Set: NetWitness
RSA Product/Service Type:  Event Stream Analysis, Concentrator
RSA Version/Condition: 10.4 and above 
Platform: CentOS
IssueIssue in fetching the raw content from Concentrator. Below error can be seen when click on alert count in alerts --> summary tab --> click on alert count --> under events. 
User-added image
ResolutionPlease follow the below steps in order to load the raw content in ESA:-
  1. Re-add the data source as Concentrator in ESA. 
    1. Open the SA Web Interface. 
    2. Go to services and select the "ESA" config page. 
    3. Remove the added concentrator under data sources and re-add it back. 
        Below is the reference link for re-adding the data source in ESA:-
        https://community.rsa.com/docs/DOC-42319
         
  2. Restart the rsa-esa service using the below commands:-
    #service rsa-esa stop 
    #service rsa-esa start
     
  3. Go to the alert count again and you should be able to see raw content. 

Attachments

    Outcomes