Reporting Engine > Error occurred while fetching data from source
Few are our reports on SA server are failing with the reason pasted below :
Executed in 0.7 sec and Error occurred while fetching data from source 'Broker[x.x.x.x]'. Error details : Error occurred while fetching data from devices connected to ''Broker[x.x.x.x]'. Please check logs for more details.
status rsasoc_re ( Looks good )
tail -f /var/log/messages
tail -f /home/rsasoc/rsa/soc/reporting-engine/logs/audit/audit.log
tail -f /home/rsasoc/rsa/soc/reporting-engine/logs/reporting-engine.log
tail -f /var/lib/netwitness/uax/logs/audit
All the above tail commands when executed are referring as 'Please check logs for more details.'
Question : Where i can find the exact logs ( path and folder name ) which tells why it's failing .
Note : RE > config > Logging configuration > log level is set to 'Error'
- Community Thread
- Forum Thread
- Reporting Engine
- RSA NetWitness
- RSA NetWitness Platform
We usually see this kind of error when the Data Source, in this case your Broker, has changed its internal ID. Due to the internal ID change the report can no longer find the Data Source even though you see the Broker in the Data Source tab. The easiest way to fix this issue is to go to the Reporting Engine's Data Source tab, remove the broker Data Source and then add it back in as a Data Source. What this does is updates the Reporting Engine's internal pointer so it points to the correct Broker ID. We have seen where some reports work fine and others fail and it still be the Data Source's ID that causes the issue.
As to your question about the log location, it should be in /home/rsasoc/rsa/soc/reporting-engine/logs/reporting-engine.log or you can click on the Log area of the Reporting Engine service.
Contacted support and resolved the issue. After version 10.5, the physical IP address is no longer accepted asthe host IP which was why the Reporting Engine services weren't populating. I changed the IP address for the broker under the host tab to 127.0.0.1. Afterwards, I restarted the jettysrv services and verified connectivity with reporting engine. Broker services became available under Config>Source tab.