Skip to content
  • There are no suggestions because the search field is empty.

RSA Security Analytics Windows Legacy Collector services stop with the message 'An error occurred creating an AMQP channel: Connection refused'

Issue

RSA Security Analytics Windows Legacy Collector services stop with the message "An error occurred creating an AMQP channel: Connection refused".

Errors similar to the following are displayed:

Mar  2 05:13:03 NWLOGDECODER nw[2482]: [MessageBrokerStats] [failure] Message-Broker Statistics: failed to get statistics /api/nodes
Mar  2 05:13:03 NWLOGDECODER nw[2482]: [AMQPClientBase] [failure] An error occurred creating an AMQP channel: Connection refused
Mar  2 05:13:03 NWLOGDECODER nw[2482]: [LogdecoderProcessor] [failure] [queue.checkpoint] [idle] Failed during getWork: Connection refused
Mar  2 05:13:03 NWLOGDECODER nw[2482]: [MessageBrokerStats] [failure] Message-Broker Statistics: failed to get statistics /api/shovels
Mar  2 05:13:03 NWLOGDECODER nw[2482]: [AMQPClientBase] [failure] An error occurred creating an AMQP channel: Connection refused
Mar  2 05:13:03 NWLOGDECODER nw[2482]: [LogdecoderProcessor] [failure] [queue.file] [idle] Failed during getWork: Connection refused
Mar  2 05:13:03 NWLOGDECODER nw[2482]: [AMQPClientBase] [failure] An error occurred creating an AMQP channel: Connection refused
Mar  2 05:13:03 NWLOGDECODER nw[2482]: [LogdecoderProcessor] [failure] [queue.odbc] [idle] Failed during getWork: Connection refused


Cause

This issue may be caused due to multiple reasons, such as the Message Broker not running or the Message Broker connection settings being incorrect.

However, another reason involving part of the functionality of the RabbitMQ is that the RabbitMQ does not have a disk space threshold in place and it is instead calculated based on the drive size, as shown in the screenshot below.

RSA Security Analytics Windows Legacy Collector services stop with the message 'An error occurred creating an AMQP channel: Connection refused'

To view the configuration parameters, you may access the following:  localhost:50101/event-broker/stats/nodes/logcollector@localhost

NOTE:  The port may be different based on the device configuration.

If the threshold has reached the set limit, the queue will not be processed and it will accumulate here:  C:\Netwitness\ng\logcollector\rabbitmq\mnesia\logcollector@localhost-nmesia\msg_store_persistent


Resolution

In order to resolve the issue, it is recommended that you follow the steps below.

1. Stop nwlogcollector service in the windows machine
2. Stop rabbitmq
3. Verify your partitions and check the free space available.
4. Check the rabbitmq queue here:  C:\Netwitness\ng\logcollector\rabbitmq\mnesia\logcollector@localhost-mnesia\msg_store_peristent

If the the amount of files cover 10% of the drive space, delete data until free space exceeds the set threshold limit.
 

If you are unsure of any of the steps above or experience any issues, contact RSA Support and quote this article ID for further assistance.


Notes

File Locations:

Log:  C:\Netwitness\ng\logcollector\rabbitmq
Database:  C:\Netwitness\ng\logcollector\rabbitmq\mnesia\logcollector@localhost-mnesia
RabbitMQ Config file:  C:\Netwitness\ng\logcollector\rabbitmq/config/rabbitmq.config


Internal Comments

David Cordero -- 6/3/2014
Created the article.

Jeff Shurtliff -- 8/8/2014
Updated article and made changes to abide by Primus best practices.

Mehdi Behamin -- 3/2/2015
Changing the audience of the article from External to Internal only to prevent any customer to delete his data.

Product Details

RSA Security Analytics
RSA Security Analytics Log Collector
RSA Security Analytics Windows Legacy Collector

Approval Reviewer Queue

ASOC Approval Group