000035638 - Error message "Error 400 on SERVER" while upgrading the NetWitness Server to RSA Security Analytics 10.6.4

Document created by RSA Customer Support Employee on Nov 16, 2017•Last modified by RSA Customer Support Employee on Nov 16, 2017
Version 2Show Document
  • Comment • 0
  • View in full screen mode

Article Content

Article Number000035638
Applies ToRSA Product Set: NetWitness Logs and Packets
RSA Product/Service Type: User Interface, Security Analytics Server / NetWitness Server
RSA Version/Condition: 10.6.x.x
 
IssueWhen initiating an update on an RSA NetWitness appliance via the RSA Security Analytics UI the error message below is displayed.

Error in Update. View details.

When running the puppet agent -t command on an appliance the error message below is displayed.

[root@sa-server /]# puppet agent -t
Info: Loading facts
Info: Retrieving pluginfacts
Info: Retrieving plugin
Info: Loading facts
Error: Could not retrieve catalog from remote server: Error 400 on SERVER: Failed when searching for node facc4daa-f52d-47b1-9f2b-f74a627ae63f: Cannot allocate memory - fork(2)
Warning: Not using cache on failed catalog
Error: Could not retrieve catalog; skipping run
CauseThis issue occurs because the puppetmaster is unable to access the mongo database.
ResolutionTo resolve the issue, connect to the affected appliance via SSH and restart the tokumx service.

[root@sa-server /]# service tokumx restart
Stopping tokumx:                                           [  OK  ]
Starting tokumx:                                           [  OK  ]

After restarting the service the puppet agent -t will run successfully as shown below.

[root@sa-server /]# puppet agent -t
Info: Loading facts
Info: Retrieving pluginfacts
Info: Retrieving plugin
Info: Loading facts
Info: Caching catalog for facc4daa-f52d-47b1-9f2b-f74a627ae63f
Info: Applying configuration version '1508073610'

You will then be able to update the RSA Security Analytics UI to 10.6.4.0 from the Hosts page. 
User-added image

Attachments

    Outcomes