ESA Config: Troubleshooting

Document created by RSA Information Design and Development on Jun 25, 2017
Version 1Show Document
  • View in full screen mode
                                           

Error Trying to Deploy ESA Rule with Custom Meta

  1. Created a custom meta key to enrich rule results and used that key in an ESA rule.
  2. Deployed rule, but received error.
Cause ESA schema is not updated with the custom meta.

Recommended Action

Restart ESA service.

Test Connection fails while updating Schema in ESA

  1. Created a custom meta key using custom feed.
  2. Test connection fails while updating schema in ESA.
Cause Lost connection to the Concentrator or ESA services.

Recommended Action

Complete one of the following actions:

  • Restart the ESA service
  • Delete the Concentrator data source from the ESA service and add it back to the ESA service.

When an All In One host is deployed, ESA cannot connect to the Concentrator

On the ESA > Config page > Data Sources tab, when you try to add a Concentrator service running on an All In One installation, the following error condition occurs: com.rsa.netwitness.carlos.transport.TransportException
Cause When an AIO host (either Packet or Log) is deployed, SA automatically assigns the loopback address 127.0.0.1 to the AIO host.

Recommended Action

  1. On the Administration > Host page, manually create a new host using the AIO host's fixed IP address (for example, 10.10.10.10).
  2. The Concentrator service on the host should be automatically added to the Administration > Services page. If not, manually create the Concentrator service.
  3. On the Administration > Service > ESA > Config > Data Sources tab, click the plus sign (+) to add the Concentrator service that is mapped to the fixed IP address.
Next Topic:References
You are here
Table of Contents > Troubleshooting ESA Configuration Issues

Attachments

    Outcomes