000034832 - "Could not load content. Service is unreachable." error  on ESA with All-in-one appliance in RSA NetWitness

Document created by RSA Customer Support Employee on Mar 16, 2017Last modified by RSA Customer Support Employee on Apr 14, 2017
Version 3Show Document
  • View in full screen mode

Article Content

Article Number000034832
Applies ToRSA Product Set: NetWitness
RSA Product/Service Type:  Event Stream Analysis, Concentrator
RSA Version/Condition:10.4 and above 
Platform: CentOS
IssueIssue in fetching the raw content from Concentrator. Below error can be seen when click on alert count in alerts --> summary tab --> click on alert count --> under events. 
User-added image
ResolutionPlease follow the below steps in order to load the raw content in ESA:-
1. Re-add the data source as Concentrator in ESA. 
a. Open the SA Web Interface 
b. Go to services and select " ESA" config page. 
c. Remove the added concentrator under data sources and re-add it back. 
Below is the reference link for re-adding the data source in ESA:-
2. Restart the rsa-esa service using below commands:-
#service rsa-esa stop 
#service rsa-esa start
3. Navigate to the alert count again and you should be able to see raw content.