AnsweredAssumed Answered

RSA Security Analytics - Incident Management Services Issue

Question asked by Andrea Saldamarco on Sep 12, 2016
Latest reply on Sep 13, 2016 by Andrea Saldamarco

Dear Support,

We are facing a problem during the configuration and integration between RSA Security Analytics Incident Management and RSA Archer with SecOps 1.3.

These are our appliances names and IPs:

 

MLNSASRV

SA SERVER

IP 10.192.72.166

MLNSAESA

ESA SERVER      

IP 10.192.72.168

 

Actually we have this error while accessing the Incident Management->Configure page from the SA GUI:

Failed to authenticate to database [im], username = [rsaimusr], password = [********]

 

In the SA IM Log we have these errors (see also the attached file)

Failed to authenticate to database [im], username = [rsaimusr], password = [********]

Could not connect to database 10.192.72.168:27017/im

 

On the SA IM Service Information (View->System) I have this values:

 

Hostname

mlnsasrv

Home Directory

/opt/rsa/im      

 

The /opt/rsa/im directory is present on the SA Server but not on the ESA Server.

 

If I test the port indicated in the SA IM Config page is working as reported below

[root@mlnsasrv ~]# curl http://10.192.72.168:27017

You are trying to access MongoDB on the native driver port. For http diagnostic access, add 1000 to the port number

[root@mlnsasrv ~]#

 

Thanks so much for your collaboration.

Kind regards

Andrea Saldamarco

Outcomes