The purpose of this article is to alert other customers of this hidden BETA feature that engineering think that is disabled by default when it's not.
There is a bug open with RSA since 2016 but based on the evidence it doesn't seem that they want to fix it.
This feature completely made rabbitmq, IM and SMS to collapse in 10.6 and Support were investigating for more than a month to figure out what was the problem.
Eventually RSA CE asked us to drop the contents of 3 tables which accounted for 18GB of uncompressed data.
Engineering initially thought that is was us (the customer) enabling it, before I provided plenty of screenshots showing the opposite. Then they made this statement:
"ESM baseline analytics related collections seem to be taking good amount of space in memory. So the automatic monitoring (its in beta) is disabled in many other environments."
To my surprise, I see that a BETA feature with its tables not maintained, could eventually affect rabbitmq,SMS and IM (even though ESM is not a separate service) as it is still enabled by default in v11. Not impressed.
If you face similar problems with services falling apart without explanation, check if you have this "very well tested feature" enabled by default.
You can quickly check the size of esm db, and it should be a few hundred MBs, even though there is no mechanism in place to purge old data so I can't think of how you would have a few MBs if this was enabled.
On SA server:
Then check the size of ESM
To perform the cleanup:
On SA server:
service puppet stop
service rsa-sms stop
On the mongo prompt:
service rsa-sms start
service puppet start