000036782 - The RSA Security Analytics UI is down after upgrading to version 10.6.6

Document created by RSA Customer Support Employee on Sep 27, 2018•Last modified by RSA Customer Support Employee on Oct 1, 2018
Version 2Show Document
  • Comment • 0
  • View in full screen mode

Article Content

Article Number000036782
Applies ToRSA Product Set: Security Analytics, NetWitness Logs & Network
RSA Product/Service Type: Security Analytics Server, User Interface
RSA Version/Condition: 10.6.6
IssueAfter upgrading the SA Server to 10.6.6, the UI is down and it is not even restarting when you run the following command:

start jettysrv

 
You can also see that the tokumx service is down and is not able to start with the following command:

service tokumx start


 
CauseThe tokumx.conf file contains a stale entry that is preventing the tokumx service to start. The jettysrv service is also unable to start since it depends on the tokumx service to run properly.
ResolutionCheck the tokumx.conf file and make sure there are no stale/duplicate entries. A normal tokumx.conf file should contain entries similar to the following ones:


# cat /etc/tokumx.conf
dbpath = /var/lib/netwitness/database/tokumx
logpath = /var/log/tokumx/tokumx.log
logappend = true
fork = true
pidfilepath = /var/run/tokumx/tokumx.pid
pluginsDir = /usr/lib64/tokumx/plugins
cacheSize = 16G
nohttpinterface = true
bind_ip = 127.0.0.1


In multiple circumstances a duplicate entry for "bind_ip = 0.0.0.0" has been discovered which was causing the issue.
 

Attachments

    Outcomes