000035749 - Issue with user interface availability on an All-in-One during RSA Security Analytics 10.6.0.0 to 10.6.4.0 upgrade

Document created by RSA Customer Support Employee on Dec 9, 2017•Last modified by RSA Customer Support Employee on Mar 25, 2019
Version 2Show Document
  • Comment • 0
  • View in full screen mode

Article Content

Article Number000035749
Applies ToRSA Product Set: NetWitness Logs & Network, Security Analytics
RSA Product/Service Type: Security Analytics UI, All-In-One (AIO) Appliance
RSA Version/Condition: 10.6.0.0, 10.6.4.X
Platform: CentOS
O/S Version: EL6
IssueWhen you update RSA Security Analytics from 10.6.0.0 to 10.6.4.0, the RSA Security Analytics UI becomes unavailable.
CauseThe RSA Security Analytics UI becomes unavailable due to a jettysrv dependency in both the rsa-sms and rabbitmq-server services.  The rsa-sms service is also dependent on the rabbitmq-server service.

The error below is found in the /var/lib/netwitness/uax/logs/sa.log file.

2016-09-08 11:57:04,550 [Appliance cache Updater 1436286190] ERROR com.rsa.smc.sa.core.util.carlos.ApplianceServiceCarlosMessageProcessor - Fcom.rsa.netwitness.carlos.transport.TransportException: java.net.ConnectException: Connection refused
        at com.rsa.netwitness.carlos.transport.spi.AbstractMessageDestination.doStart(AbstractMessageDestination.java:178)
        at com.rsa.netwitness.carlos.transport.spi.AbstractMessageEndpoint.start(AbstractMessageEndpoint.java:100)
        at ailed to send request to System Management Service, possible reason Cannot connect to RabbitMQ Service
com.rsa.netwitness.carlos.transport.TransportException: com.rsa.netwitness.carlos.transport.TransportException: com.rsa.netwitness.carlos.transport.TransportException: java.net.ConnectException: Connection refused



 
ResolutionRSA Security Analytics AIO devices are no longer supported beginning in RSA NetWitess 11. If this issue has occurred in 10.6.x the workaround is recommended.
If you are experiencing this issue and still need assistance, contact RSA Customer Support and quote this article number.
WorkaroundExecute the following command once you initiate an update:

puppet agent -t

The above command should restart any stopped services such as rabbitmq-server or rsa-sms.

If issues persist then further troubleshooting will need to be performed on the rabbitmq-server service.
NotesThe following line in /etc/init/jettysrv.conf shows the dependencies of jettysrv:

if [[ `/sbin/service rabbitmq-server status | grep -i 'running_applications'` && `/sbin/service tokumx status | grep -i 'run'` ]] && ! [[ `/sbin/service rsa-sms status | grep -i -E 'not[[:space:]]+run'` ]]

The dependencies are:

  • rabbitmq-server
  • tokumx
  • rsa-sms

Attachments

    Outcomes