000035935 - "Service is already in this deployment" is returned when adding an Event Stream Analysis service in RSA NetWitness

Document created by RSA Customer Support Employee on Feb 12, 2018
Version 1Show Document
  • View in full screen mode

Article Content

Article Number000035935
Applies To

RSA Product Set:- Netwitness
RSA Product/Service Type:- ESA, SA Server
RSA Version/Condition: 10.5.x, 10.6.x
Platform: CentOS

IssueAn error similar to below occurs when trying to add an Event Stream Analysis service to ESA Services under SA Web GUI > Alerts > Configure > DEPLOYMENTS.
""Service is already in this deployment" The service "ESA - Event Stream Analysis" is already part of the deployment "TEST ESA""
CauseThe error is returned when esaServiceInfos field in the synchronization table already contains some values. Synchronization database resides on SA server and it stores Event Stream Analysis rules & deployment details.

1. Open the SSH to SA Server and run the below commands to verify the deployment name.
An example of the expected output is shown below with the name of deployment highlighted in red.


#mongo sa
> db.synchronization.find().pretty()
        "_id" : ObjectId("58a2af3ce4b0bca8c6393661"),
        "_class" : "com.rsa.smc.sa.esa.domain.bean.Synchronization",
        "name" : "TEST ESA",
        "esaServiceInfos" : [
                        "deviceId" : NumberLong(7),
                        "hostname" : "x.x.x.x",
                        "port" : 50030,
                        "lastSuccessfulSync" : ISODate("2017-12-31T16:38:34.515Z"),
                        "successfulSync" : true,
                        "master" : false

2. To clear esaServiceInfos field from the synchronization table in Mongo SA, run below command on SSH to SA Server
#mongo sa
> db.synchronization.update({name:"<name of deployment>"},{$unset: {"esaServiceInfos": ""}}) 

e.g.db.synchronization.update({name:"TEST ESA"},{$unset: {"esaServiceInfos": ""}}) if the name of deployment is "TEST ESA".

3. Add the Event Stream Analysis service to ESA Services under SA Web GUI > Alerts > Configure > DEPLOYMENTS. 
You should be successfully able to add the ESA service to ESA Services now.