AnsweredAssumed Answered

i am not able to add reporting engine in security analytics

Question asked by Rajbir Yadav on Oct 29, 2013
Latest reply on May 15, 2014 by hubba900

Like • Show 0 Likes0
Comment • 23

i am currently working on Virtual Testing Environment of RSA Security Analytics. I have successfully deployed all components(SA server, Concentrator, Decoder and Log Decoder) VM in our Esxi Server. All the components are licensed and active and also working properly. But i have an issue with Reporting Engine whenever i tried to add device Reporting Engine and check test connection, it shows test connection failed and i am not able to add Reporting engine in the Devices.

IP address detail: Example

SA server: 192.168.1.129/24

Concentrator: 192.168.1.88/24

Decoder: 192.168.1.168/24

Log Decoder: 192.168.1.49/24

I am trying to add Reporting Engine on 192.168.1.129 or 127.0.0.1 but its failed on both cases. I have also tried to add Reporting Engine

After redeployment of all VMs and got the same error. Please find the attached Screen shot of the error.

Please help on this issue.

Thanks in advance

Attachments

Screen 2.jpg119.7 KB

No one else has this question

Outcomes

23 Replies

Craig_RSA Oct 30, 2013 5:36 AM
Mark Correct
Correct Answer
Hi Rajveer,
Can you add the reporting engine using "localhost" in place of the static/loopback IP? If not you may be required to re-initialise the reporting engine, support should be able to assist you with this task.

Craig
Like • Show 1 Like1
Actions
- coCSAbzLgBkDkKhBc0SOLbnhEWBpZGxpdaFGPIwaUpg= @ Craig_RSA on Nov 6, 2013 2:18 PM
  Mark Correct
  Correct Answer
  I as well use "localhost" and never have any problems. This should fix your problem.
  Like • Show 0 Likes0
  Actions
- Rajbir Yadav @ Craig_RSA on Nov 7, 2013 5:50 AM
  Mark Correct
  Correct Answer
  Hi Craig_RSA, Adam Rasnic, James_herbst
  
  i have also tried with "localhost" but then too i got the same error. well i am trying to take RSA support help but still my case in pending.
  
  And i think if we have not added the reporting engine till then we cant stop and start it. because no reporting service is there.
  if i am wrong then plz correct me.
  
  well, thanx for response.
  Like • Show 0 Likes0
  Actions
  - jAMES HERBST @ Rajbir Yadav on Nov 7, 2013 8:19 AM
    Mark Correct
    Correct Answer
    As I mentioned, I haven't worked with Security Analytics on VM. We have physical appliances; log and packet decoders, concentrators, hybrids, etc. I find it much more reliable to ssh into the appliances to start and stop services. The GUI still has some issues that I don't think have been completely worked out. Hope that makes more sense to what I had said in my last post to your question.
    Like • Show 0 Likes0
    Actions
  - coCSAbzLgBkDkKhBc0SOLbnhEWBpZGxpdaFGPIwaUpg= @ Rajbir Yadav on Nov 7, 2013 11:55 AM
    Mark Correct
    Correct Answer
    What devices have you deployed and what version are those devices running?
    Like • Show 0 Likes0
    Actions
    - jAMES HERBST @ coCSAbzLgBkDkKhBc0SOLbnhEWBpZGxpdaFGPIwaUpg= on Nov 7, 2013 12:09 PM
      Mark Correct
      Correct Answer
      SA Server (broker/reporting engine/IPDB) x2 (PROD & DR)
      Log Decoder x2 (PROD & DR)
      Log Concentrator x2 (PROD & DR)
      Packet Hybrid (decoder/concentrator) x5 (Multi GEO Locations)
      Log Hyrbid (decoder/concentrator/collector) x5 (Multi GEO Locations)
      
      All appliances had 10.0 when I started, currently on the latest release v 10.2 SP2
      Like • Show 0 Likes0
      Actions
      - coCSAbzLgBkDkKhBc0SOLbnhEWBpZGxpdaFGPIwaUpg= @ jAMES HERBST on Nov 7, 2013 12:26 PM
        Mark Correct
        Correct Answer
        I think at one point I had the same issue. You might try forcing the update of the reporting engine on the server.
        
        rpm --force -Uvh **re_server RPM filename**
        
        --Not sure if you will need to stop services on the server or not, it probably wouldnt hurt to be for sure though. I think I actually did a full restart on the server afterwards to make sure I had a clean slate for all changes to take effect when it came back up.
        Like • Show 0 Likes0
        Actions
jAMES HERBST Nov 6, 2013 3:53 PM
Mark Correct
Correct Answer
I've not worked with SA on VM's, but I have had similar issues with collectors in the past. It usually came down to a simple solution that the service wasn't running.

I would check to make sure the service running as well.

stop rsasoc_re
start rsasoc_re
Like • Show 0 Likes0
Actions
huan zhou Nov 8, 2013 2:33 AM
Mark Correct
Correct Answer
try:
[root@saNre ~]# netstat -an | grep 51113
tcp 0 0 ::ffff:127.0.0.1:51113 :::* LISTEN
if no return, that mean service not running.
check:
/home/rsasoc/rsa/soc/reporting-engine/logs/*.log see what's the error when restarting the report engine
if really cannot fix:
uninstall and reinstall (re-server-10.2.5.2-2.noarch.rpm)
Like • Show 0 Likes0
Actions
huan zhou Nov 25, 2013 9:17 AM
Mark Correct
Correct Answer
has the issue resolved?
Like • Show 0 Likes0
Actions
- Rajbir Yadav @ huan zhou on Nov 25, 2013 9:35 AM
  Mark Correct
  Correct Answer
  Yes, this issue is resolved.
  
  thanks
  Like • Show 0 Likes0
  Actions
  - huan zhou @ Rajbir Yadav on Nov 25, 2013 9:43 AM
    Mark Correct
    Correct Answer
    can share the solution?
    Like • Show 0 Likes0
    Actions
    - Rajbir Yadav @ huan zhou on Nov 25, 2013 12:06 PM
      Mark Correct
      Correct Answer
      Hey patriot,
      
      that’s not a solution, I just try to add reporting engine before all other device and its work. I tried 3 or 4 time and it works all the time.
      Like • Show 0 Likes0
      Actions
    - Rajbir Yadav @ huan zhou on Nov 25, 2013 12:22 PM
      Mark Correct
      Correct Answer
      Hi patriot3w/Adam
      
      After mapping the DAC I got concentrator is showing its storage in GUI (select device >stats) but packet decoder is not showing its storage in GUI.
      
      or when I run nwraidutil.py then its showing all the disk are online and when I run df –h then its showing all database storage is increased.
      
      Why decoder is not showing its storage online in GUI?
      Like • Show 0 Likes0
      Actions
      - coCSAbzLgBkDkKhBc0SOLbnhEWBpZGxpdaFGPIwaUpg= @ Rajbir Yadav on Nov 27, 2013 3:54 PM
        Mark Correct
        Correct Answer
        Has the storage showed up in the GUI yet?
        
        | Adam Rasnick | Practice Consultant, RSA Professional Services| 423.833.9297| adam.rasnick@emc.com | RSA The Security Division of EMC
        Like • Show 0 Likes0
        Actions
        Rajbir Yadav @ coCSAbzLgBkDkKhBc0SOLbnhEWBpZGxpdaFGPIwaUpg= on Nov 28, 2013 8:32 AM
        Mark Correct
        Correct Answer
        Adam Rasnick
        no still its showing with question mark have a look on this pic
        Like • Show 0 Likes0
        Actions
        coCSAbzLgBkDkKhBc0SOLbnhEWBpZGxpdaFGPIwaUpg= @ Rajbir Yadav on Dec 2, 2013 1:51 PM
        Mark Correct
        Correct Answer
        Can you provide a screenshot of the output of the command df -h
        
        | Adam Rasnick | Practice Consultant, RSA Professional Services| 423.833.9297| adam.rasnick@emc.com | RSA The Security Division of EMC
        Like • Show 0 Likes0
        Actions
        Rajbir Yadav @ coCSAbzLgBkDkKhBc0SOLbnhEWBpZGxpdaFGPIwaUpg= on Dec 2, 2013 2:19 PM
        Mark Correct
        Correct Answer
        i just upgrade the decoder and its resolved, thanks asking for help
        Like • Show 0 Likes0
        Actions
        coCSAbzLgBkDkKhBc0SOLbnhEWBpZGxpdaFGPIwaUpg= @ Rajbir Yadav on Dec 2, 2013 2:25 PM
        Mark Correct
        Correct Answer
        GREAT! Glad that worked out!
        
        | Adam Rasnick | Practice Consultant, RSA Professional Services| 423.833.9297| adam.rasnick@emc.com | RSA The Security Division of EMC
        Like • Show 0 Likes0
        Actions
RSA Admin Dec 19, 2013 5:26 AM
Mark Correct
Correct Answer
We had the same issue yesterday with Reporting Engine on a new 10.3 install,

Service rsasoc_re started and listening on 51113, but unable to add the device using web interface (127.0.0.1 or localhost)

another laptop on the same screen, with the same value (localhost) on the same time could Test Connection and correctly add the device ?!?

I think we just need to be patient
Like • Show 0 Likes0
Actions
- hubba900 @ RSA Admin on May 14, 2014 9:37 AM
  Mark Correct
  Correct Answer
  I have new (reimage) SA server. Have installed re-server 10.3.3 package, but can't add to reporting engine via Web UI. Port 51113 listened. I don't understand where a problem.
  
  2014-05-14 13:29:05,481 [main] INFO com.rsa.netwitness.carlos.server.context.CarlosContextListener - Home directory located at /home/rsasoc/rsa/soc/reporting-engine
  2014-05-14 13:29:05,529 [main] INFO com.rsa.netwitness.carlos.server.context.CarlosContextListener - Carlos Database directory located at null
  2014-05-14 13:29:17,148 [main] INFO com.rsa.soc.re.contentstore.jcr.JCRContentStore - Init repository starting
  2014-05-14 13:29:18,209 [main] INFO com.rsa.soc.re.contentstore.jcr.JCRContentStore - Adding root package
  2014-05-14 13:29:18,258 [main] INFO com.rsa.soc.re.contentstore.jcr.JCRContentStore - Checking for node type : REPORT
  2014-05-14 13:29:18,259 [main] INFO com.rsa.soc.re.contentstore.jcr.JCRContentStore - Node type already exists : REPORT
  2014-05-14 13:29:18,260 [main] INFO com.rsa.soc.re.contentstore.jcr.JCRContentStore - Checking for node type : REPORTGROUP
  2014-05-14 13:29:18,261 [main] INFO com.rsa.soc.re.contentstore.jcr.JCRContentStore - Node type already exists : REPORTGROUP
  2014-05-14 13:29:18,261 [main] INFO com.rsa.soc.re.contentstore.jcr.JCRContentStore - Checking for node type : RULE
  2014-05-14 13:29:18,262 [main] INFO com.rsa.soc.re.contentstore.jcr.JCRContentStore - Node type already exists : RULE
  2014-05-14 13:29:18,262 [main] INFO com.rsa.soc.re.contentstore.jcr.JCRContentStore - Checking for node type : RULEGROUP
  2014-05-14 13:29:18,263 [main] INFO com.rsa.soc.re.contentstore.jcr.JCRContentStore - Node type already exists : RULEGROUP
  2014-05-14 13:29:18,263 [main] INFO com.rsa.soc.re.contentstore.jcr.JCRContentStore - Checking for node type : RUNDEF
  2014-05-14 13:29:18,264 [main] INFO com.rsa.soc.re.contentstore.jcr.JCRContentStore - Node type already exists : RUNDEF
  2014-05-14 13:29:18,264 [main] INFO com.rsa.soc.re.contentstore.jcr.JCRContentStore - Checking for node type : RUNGROUP
  2014-05-14 13:29:18,266 [main] INFO com.rsa.soc.re.contentstore.jcr.JCRContentStore - Node type already exists : RUNGROUP
  2014-05-14 13:29:18,266 [main] INFO com.rsa.soc.re.contentstore.jcr.JCRContentStore - Checking for node type : TEMPLATE
  2014-05-14 13:29:18,267 [main] INFO com.rsa.soc.re.contentstore.jcr.JCRContentStore - Node type already exists : TEMPLATE
  2014-05-14 13:29:18,267 [main] INFO com.rsa.soc.re.contentstore.jcr.JCRContentStore - Checking for node type : LIST
  2014-05-14 13:29:18,268 [main] INFO com.rsa.soc.re.contentstore.jcr.JCRContentStore - Node type already exists : LIST
  2014-05-14 13:29:18,268 [main] INFO com.rsa.soc.re.contentstore.jcr.JCRContentStore - Checking for node type : LISTGROUP
  2014-05-14 13:29:18,269 [main] INFO com.rsa.soc.re.contentstore.jcr.JCRContentStore - Node type already exists : LISTGROUP
  2014-05-14 13:29:18,269 [main] INFO com.rsa.soc.re.contentstore.jcr.JCRContentStore - Checking for node type : ALERT
  2014-05-14 13:29:18,271 [main] INFO com.rsa.soc.re.contentstore.jcr.JCRContentStore - Node type already exists : ALERT
  2014-05-14 13:29:18,271 [main] INFO com.rsa.soc.re.contentstore.jcr.JCRContentStore - Checking for node type : CHART
  2014-05-14 13:29:18,272 [main] INFO com.rsa.soc.re.contentstore.jcr.JCRContentStore - Node type already exists : CHART
  2014-05-14 13:29:18,272 [main] INFO com.rsa.soc.re.contentstore.jcr.JCRContentStore - Checking for node type : CHARTGROUP
  2014-05-14 13:29:18,273 [main] INFO com.rsa.soc.re.contentstore.jcr.JCRContentStore - Node type already exists : CHARTGROUP
  2014-05-14 13:29:18,299 [main] INFO com.rsa.soc.re.contentstore.jcr.JCRContentStore - Init repository completed.
  2014-05-14 13:29:18,392 [main] INFO com.rsa.soc.re.contentstore.jcr.JCRContentStore - Init repository starting
  2014-05-14 13:29:18,392 [main] INFO com.rsa.soc.re.contentstore.jcr.JCRContentStore - Adding root package
  2014-05-14 13:29:18,394 [main] INFO com.rsa.soc.re.contentstore.jcr.JCRContentStore - Checking for node type : REPORT
  2014-05-14 13:29:18,394 [main] INFO com.rsa.soc.re.contentstore.jcr.JCRContentStore - Node type already exists : REPORT
  2014-05-14 13:29:18,395 [main] INFO com.rsa.soc.re.contentstore.jcr.JCRContentStore - Checking for node type : REPORTGROUP
  2014-05-14 13:29:18,395 [main] INFO com.rsa.soc.re.contentstore.jcr.JCRContentStore - Node type already exists : REPORTGROUP
  2014-05-14 13:29:18,396 [main] INFO com.rsa.soc.re.contentstore.jcr.JCRContentStore - Checking for node type : RULE
  2014-05-14 13:29:18,396 [main] INFO com.rsa.soc.re.contentstore.jcr.JCRContentStore - Node type already exists : RULE
  2014-05-14 13:29:18,396 [main] INFO com.rsa.soc.re.contentstore.jcr.JCRContentStore - Checking for node type : RULEGROUP
  2014-05-14 13:29:18,397 [main] INFO com.rsa.soc.re.contentstore.jcr.JCRContentStore - Node type already exists : RULEGROUP
  2014-05-14 13:29:18,397 [main] INFO com.rsa.soc.re.contentstore.jcr.JCRContentStore - Checking for node type : RUNDEF
  2014-05-14 13:29:18,398 [main] INFO com.rsa.soc.re.contentstore.jcr.JCRContentStore - Node type already exists : RUNDEF
  2014-05-14 13:29:18,398 [main] INFO com.rsa.soc.re.contentstore.jcr.JCRContentStore - Checking for node type : RUNGROUP
  2014-05-14 13:29:18,399 [main] INFO com.rsa.soc.re.contentstore.jcr.JCRContentStore - Node type already exists : RUNGROUP
  2014-05-14 13:29:18,399 [main] INFO com.rsa.soc.re.contentstore.jcr.JCRContentStore - Checking for node type : TEMPLATE
  2014-05-14 13:29:18,400 [main] INFO com.rsa.soc.re.contentstore.jcr.JCRContentStore - Node type already exists : TEMPLATE
  2014-05-14 13:29:18,400 [main] INFO com.rsa.soc.re.contentstore.jcr.JCRContentStore - Checking for node type : LIST
  2014-05-14 13:29:18,400 [main] INFO com.rsa.soc.re.contentstore.jcr.JCRContentStore - Node type already exists : LIST
  2014-05-14 13:29:18,401 [main] INFO com.rsa.soc.re.contentstore.jcr.JCRContentStore - Checking for node type : LISTGROUP
  2014-05-14 13:29:18,401 [main] INFO com.rsa.soc.re.contentstore.jcr.JCRContentStore - Node type already exists : LISTGROUP
  2014-05-14 13:29:18,402 [main] INFO com.rsa.soc.re.contentstore.jcr.JCRContentStore - Checking for node type : ALERT
  2014-05-14 13:29:18,402 [main] INFO com.rsa.soc.re.contentstore.jcr.JCRContentStore - Node type already exists : ALERT
  2014-05-14 13:29:18,402 [main] INFO com.rsa.soc.re.contentstore.jcr.JCRContentStore - Checking for node type : CHART
  2014-05-14 13:29:18,402 [main] INFO com.rsa.soc.re.contentstore.jcr.JCRContentStore - Node type already exists : CHART
  2014-05-14 13:29:18,403 [main] INFO com.rsa.soc.re.contentstore.jcr.JCRContentStore - Checking for node type : CHARTGROUP
  2014-05-14 13:29:18,403 [main] INFO com.rsa.soc.re.contentstore.jcr.JCRContentStore - Node type already exists : CHARTGROUP
  2014-05-14 13:29:18,406 [main] INFO com.rsa.soc.re.contentstore.jcr.JCRContentStore - Init repository completed.
  2014-05-14 13:29:18,406 [main] INFO com.rsa.soc.re.contentstore.impl.ReportingContentStoreImpl - Permissions are already set for content store
  2014-05-14 13:29:19,227 [main] INFO com.rsa.soc.re.resultstore.ResultStoreCacheThreadPool - Maximum Thread pool size should greater than 1. Setting maximum thread pool size to 2
  2014-05-14 13:29:19,557 [main] INFO com.rsa.soc.re.status.manager.report.ReportStatusManagerImpl - Retrieve the deprecated running reports from database to mark with 'FAILED' state during Reporting Engine Reboot
  2014-05-14 13:29:19,593 [main] INFO com.rsa.soc.re.status.dao.report.impl.ReportStatusDAOImpl - Execute the named query to retrieve the reports with 'RUNNING' execution state from database
  2014-05-14 13:29:19,609 [main] INFO com.rsa.soc.re.status.manager.report.ReportStatusManagerImpl - Retrieve the reports from database which have FormatStatus QUEUED OR RUNNING
  2014-05-14 13:29:19,610 [main] INFO com.rsa.soc.re.status.dao.report.impl.ReportStatusDAOImpl - Execute the named query to retrieve the reports which have FormatStatus QUEUED OR RUNNING
  2014-05-14 13:29:19,613 [main] INFO com.rsa.soc.re.status.dao.report.impl.ReportStatusDAOImpl - Save the collection of entities in database: 0
  2014-05-14 13:29:19,615 [RE-CommonThreadPool-0] INFO com.rsa.soc.re.status.manager.report.ReportStatusManagerImpl - Initialize the LastExecutedReport Map during re-boot
  2014-05-14 13:29:19,618 [RE-CommonThreadPool-0] INFO com.rsa.soc.re.status.dao.report.impl.ReportStatusDAOImpl - Execute the named query to retrieve all the latest executed reports for all the run definitions from database
  2014-05-14 13:29:19,639 [RE-CommonThreadPool-0] INFO com.rsa.soc.re.status.manager.report.ReportStatusManagerImpl - Initialization of the LastExecutedReport Map completed
  2014-05-14 13:29:22,132 [main] INFO com.rsa.soc.datasource.nextgen.NextGenDataSourceConnectionFactory - No NextGen connections are initialized as there are no NextGen data source configurations found.
  2014-05-14 13:29:22,189 [main] INFO com.rsa.soc.datasource.ipdb.IPDBDataSourceConnectionFactory - No datasources of type IPDB connected.
  2014-05-14 13:29:22,249 [main] INFO com.rsa.soc.datasource.warehouse.WarehouseDataSourceConnectionFactory - No Warehouse connections are initialized as there are no Warehouse data source configurations found
  2014-05-14 13:29:22,251 [main] INFO com.rsa.soc.datasource.nextgen.CoreArchiverDataSourceConnectionFactory - No NextGen connections are initialized as there are no NextGen data source configurations found.
  2014-05-14 13:29:22,270 [main] INFO com.rsa.soc.re.status.manager.alert.AlertStatusManagerImpl - Retrieve the deprecated running alerts from database to mark with 'FAILED' state during Reporting Engine Re-Boot
  2014-05-14 13:29:22,271 [main] INFO com.rsa.soc.re.status.dao.alert.impl.AlertStatusDAOImpl - Execute the named query to retrieve the alerts with 'RUNNING' execution state from database
  2014-05-14 13:29:22,312 [main] INFO com.rsa.soc.re.scheduler.SchedulerHelper - Initializing the start of quartz scheduler
  2014-05-14 13:29:22,351 [main] INFO com.rsa.soc.re.scheduler.SchedulerHelper - Initialization of the quartz scheduler ended
  2014-05-14 13:29:22,626 [main] INFO com.rsa.soc.re.status.manager.report.ReportStatusManagerImpl - Add the observer to receive notification when execution status is completed
  2014-05-14 13:29:22,649 [main] INFO com.rsa.soc.re.status.manager.alert.AlertStatusManagerImpl - Add the observer to receive notification when execution status is completed
  2014-05-14 13:29:22,743 [main] INFO com.rsa.soc.re.outputaction.email.EmailOutputActionHandler - Cleaning up folders from previous runs
  2014-05-14 13:29:22,749 [main] INFO com.rsa.soc.re.outputaction.email.EmailOutputActionHandler - Creating new output directory
  2014-05-14 13:29:22,952 [RE-ScheduledThreadPool] INFO com.rsa.soc.re.queryprocessor.schema.SchemaRefreshJob - Datasource schema update starting
  2014-05-14 13:29:22,954 [RE-ScheduledThreadPool] INFO com.rsa.soc.re.queryprocessor.schema.SchemaRefreshJob - Datasource schema update jobs spawned
  2014-05-14 13:29:23,120 [main] INFO com.rsa.soc.re.utils.LoggingConfigManager - Explicitly setting root log level
  2014-05-14 13:29:23,179 [main] INFO com.rsa.soc.re.outputaction.syslog.SyslogProvider - Configuring UDP syslog provider
  2014-05-14 13:29:23,211 [main] INFO com.rsa.soc.datasource.sql.gp.GPDataSourceConnectionFactory - Received data source configuration change event.
  2014-05-14 13:29:23,212 [main] INFO com.rsa.soc.re.utils.LoggingConfigManager - config event recvd
  2014-05-14 13:29:23,215 [main] INFO com.rsa.netwitness.carlos.config.ConfigurationMXBean - REVersion changed by Unknown identity
  2014-05-14 13:29:23,246 [main] INFO com.rsa.soc.re.livechart.db.UpgradeLiveChartSchema - Livechart result tables schema is already updated.
  2014-05-14 13:29:24,215 [main] INFO com.rsa.netwitness.carlos.transport.impl.DefaultMessageEndpointFactory - The default local message endpoint is vives://127.0.0.1:51113?carlos.dispatch.pool=25&carlos.dispatch.queue=25
  2014-05-14 13:29:24,266 [main] INFO com.rsa.netwitness.carlos.transport.spring.MessageEndpointServiceExporter - Service on channel com.rsa.netwitness.carlos.logging.LoggingServiceProtocol$LoggingMessage bound to local endpoint vives://127.0.0.1:51113?carlos.dispatch.pool=25&carlos.dispatch.queue=25
  2014-05-14 13:29:24,293 [main] INFO com.rsa.netwitness.carlos.transport.spring.MessageEndpointServiceExporter - Service on channel com.rsa.netwitness.carlos.management.ManagementProtocol$ManagementMessage bound to local endpoint vives://127.0.0.1:51113?carlos.dispatch.pool=25&carlos.dispatch.queue=25
  2014-05-14 13:29:25,093 [main] INFO com.rsa.netwitness.carlos.transport.spring.MessageEndpointServiceExporter - Service on channel com.rsa.netwitness.carlos.reporting.ReportingServiceProtocol$ReportingMessage bound to local endpoint vives://127.0.0.1:51113?carlos.dispatch.pool=25&carlos.dispatch.queue=25
  2014-05-14 13:29:25,114 [main] INFO com.rsa.netwitness.carlos.transport.spring.MessageEndpointServiceExporter - Service on channel com.rsa.netwitness.carlos.security.SecurityManagerProtocol$SecurityManagerMessage bound to local endpoint vives://127.0.0.1:51113?carlos.dispatch.pool=25&carlos.dispatch.queue=25
  2014-05-14 13:29:25,460 [main] INFO com.rsa.netwitness.carlos.jmx.DefaultConnectorServerFactoryBean - JMX connector server started: javax.management.remote.rmi.RMIConnectorServer@73549a7c
  2014-05-14 13:29:25,462 [main] INFO com.rsa.netwitness.carlos.jmx.DefaultConnectorServerFactoryBean - JMX consoles can connect to service:jmx:rmi://RSA-AS-MD7:0/jndi/rmi://RSA-AS-MD7:50011/carlos
  2014-05-14 13:29:25,731 [main] INFO com.rsa.soc.re.status.manager.report.ReportStatusManagerImpl - Add the observer to receive notification when execution status is completed
  2014-05-14 13:29:25,883 [main] INFO com.rsa.soc.datasource.sql.gp.GPDataSourceConnectionFactory - Received data source configuration change event.
  2014-05-14 13:29:25,883 [main] INFO com.rsa.soc.re.utils.LoggingConfigManager - config event recvd
  2014-05-14 13:29:25,884 [main] INFO com.rsa.netwitness.carlos.config.ConfigurationMXBean - ConfigRE_10_3 changed by username
  2014-05-14 13:29:25,884 [main] INFO com.rsa.soc.re.scheduler.alert.AlertScheduler - Restoring the alert schedule jobs
  2014-05-14 13:29:25,885 [main] INFO com.rsa.soc.re.scheduler.alert.AlertScheduler - No of alert jobs restored : 0 (out of 0 alerts).
  2014-05-14 13:29:25,886 [main] INFO com.rsa.soc.re.livechart.run.LiveChartSchedulerImpl - Restored 0 chart jobs.
  2014-05-14 13:29:25,888 [main] INFO com.rsa.soc.re.server.startup.DeployWar - @@@ Application startup completed in 37 seconds
  Like • Show 0 Likes0
  Actions
  - huan zhou @ hubba900 on May 14, 2014 10:23 AM
    Mark Correct
    Correct Answer
    did you reinstall the reporting engine? so far what i encouter is existing rules/reports will cause the problem.
    try report the rpm, then rename the folder /home/rsasoc/rsa/soc/reporting-engine, then reinstall the rpm
    Like • Show 1 Like1
    Actions
    - hubba900 @ huan zhou on May 15, 2014 5:30 AM
      Mark Correct
      Correct Answer
      Thanks! This solution help me solve my problem!
      Like • Show 0 Likes0
      Actions

i am not able to add reporting engine in security analytics

Attachments

Outcomes

Related Content

Recommended Content