000035859 - Dashboard dashlets are not loading due to "The database is read only" error in RSA Security Analytics 10.6

Document created by RSA Customer Support Employee on Dec 23, 2017Last modified by RSA Customer Support Employee on Jul 11, 2018
Version 2Show Document
  • View in full screen mode

Article Content

Article Number000035859
Applies ToRSA Product Set: NetWitness Logs & Packets, Security Analytics
RSA Product/Service Type: Security Analytics Server, User Interface
RSA Version/Condition: 10.6.x.x
Platform: CentOS 6
 
IssueDashboard Dashlet charts are not loading in the RSA Security Analytics user interface.

User-added image
CauseBy checking the /home/rsasoc/rsa/soc/reporting-engine/logs/ files we can see the below error and highlighted messages in RED:

2017-11-21 12:39:10,888 [EXEC_LIVECHART_101_20160829091713/IPS - Intrushield Report Based on the result-1511267950847] ERROR com.rsa.soc.re.livechart.run.LiveChartTask - com.rsa.soc.re.exception.ReportingException: org.h2.jdbc.JdbcSQLException: The database is read only; SQL statement:
UPDATE CHART_SUMMARY SET LAST_EXEC_ERROR_DEC = ?, END_TIME = ?, CURRENT_EXEC_STATUS = ?, LAST_EXEC_TIME = ?, NEXT_EXEC_TIME = ?, LAST_EXEC_TIME_DUR = ?, AVG_EXEC_TIME_DUR = ?, MAX_EXEC_TIME_DUR = ?, COMPLETED_RUN_COUNT = ?  WHERE EXEC_ID = ?  [90097-174]


The highlighted message indicates that the live-charts database files are having only read permission. Therefore, the reporting-engine is not able to fetch data.


 
ResolutionPerform the steps below to resolve the issue.
  1. Connect to the Security Analytics server via SSH as the root user.
  2. Navigate to the /home/rsasoc/rsa/soc/reporting-engine/livecharts directory.

    cd /home/rsasoc/rsa/soc/reporting-engine/livecharts

  3. Change the ownership of the livechart.db file.

    chown rsasoc:rsasoc livechart.h2.db livechart.trace.db

  4. Restart the Reporting Engine service via the SSH session.

    stop rsasoc_re
    start rsasoc_re
    status rsasoc_re

Attachments

    Outcomes