Understanding RSA Security Analytics Reporting Engine Logs
Issue
Understanding RSA Security Analytics Reporting Engine LogsHow do I interpret the SA Reporting Engine logs?
How do you read the RE logs in Security Analytics?
Resolution
Starting Reporting Engine
start rsasoc_re
Reporting Engine - Service start in Log
/home/rsasoc/rsa/soc/reporting-engine/logs/reporting-engine.log:
2014-02-20 03:24:24,860 [main] INFO com.rsa.netwitness.carlos.server.context.CarlosContextListener - Home directory located at /home/rsasoc/rsa/soc/reporting-engine
2014-02-20 03:24:24,967 [main] INFO com.rsa.netwitness.carlos.server.context.CarlosContextListener - Carlos Database directory located at null
2014-02-20 03:25:06,329 [main] INFO com.rsa.soc.re.contentstore.jcr.JCRContentStore - Init repository starting
Reporting Engine - Service startup complete
/home/rsasoc/rsa/soc/reporting-engine/logs/reporting-engine.log:
2014-02-20 03:27:37,240 [main] INFO com.rsa.soc.re.server.startup.DeployWar - @@@ Application startup completed in 204 seconds
Stopping Reporting Engine
stop rsasoc_re
Reporting Engine - Service stop in Logs
/var/log/messages:
Feb 20 03:11:44 sydSA init: rsasoc_re main process (28211) terminated with status 255
/home/rsasoc/rsa/soc/reporting-engine/logs/reporting-engine.log:
2014-02-20 03:23:45,024 [ContentStore ShutdownHook] WARN com.rsa.soc.re.contentstore.jcr.jackrabbit.ShutdownJackRabbit - Shuttingdown Jackrabbit repository
2014-02-20 03:23:45,134 [StatusDB ShutdownHook] WARN com.rsa.soc.re.status.manager.ShutdownStatusManager - Closing all connections to status db
2014-02-20 03:23:45,137 [StatusDB ShutdownHook] WARN com.rsa.soc.re.status.manager.ShutdownStatusManager - All connections to status db closed
Internal Comments
UserName:shurtj5/6/2014 4:42:46 PM - Changed Article Type
Changed article to how-to and modified the statements accordingly to adhere to Primus best practices.
Product Details
RSA Security AnalyticsRSA Security Analytics Reporting Engine
Approval Reviewer Queue
Others