Skip to content
  • There are no suggestions because the search field is empty.

RSA Security Analytics Reporting Engine dashlets fail because of to many pending queries

Issue

RSA Security Analytics Reporting Engine dashlets fail because of to many pending queries.
The reporting dashlets on the Unified Dashboard fail to load.

The /home/rsasoc/rsa/soc/reporting-engine/reporting-engine.log file displays errors similar to the following:

May 30 12:03:48 Site-name nw[3003]: [Rest] [audit] User admin (session xxxxxx, 127.0.0.1:42925) has a running REST request that has timed out, returning HTTP 408
May 30 12:15:15 Site-name nw[3003]: [Broker] [failure] Language call error: There are too many pending queries at this time, please resubmit the query later


Cause

The issue occurs because the broker or concentrator that is being queried against received more queries than it is able to accept, resulting in the queries timing out.


Resolution

To remediate the issue, the following modifications may be made:

For Broker appliances with 32 CPUs and 90GB of memory, follow the steps below.

  1. Change the thread count to 31.
    1. From the Security Analytics UI, navigate to Administration -> Devices.
    2. Select the broker device and navigate to View -> Explore.
    3. Drill down to sys -> config in the navigation tree.
    4. In the right pane, change the value of threads to 31.
  3. Set the maximum concurrent queries to 32.
    1. From the Explore view, drill down to sdk -> config in the navigation tree.
    2. In the right pane, change the value of max.concurrent.queries to 32.
  5. Set the maximum pending queries to 180.
    1. In the same location from Step 2 in the Explore view, change he value of max.pending.queries to 180.

For Concentrator appliances with 32 CPUs and 90GB of memory, follow the steps below.

  1. Change the thread count to 24.
    1. From the Security Analytics UI, navigate to Administration -> Devices.
    2. Select the broker device and navigate to View -> Explore.
    3. Drill down to sys -> config in the navigation tree.
    4. In the right pane, change the value of threads to 24.
  3. Set the maximum concurrent queries to 24.
    1. From the Explore view, drill down to sdk -> config in the navigation tree.
    2. In the right pane, change the value of max.concurrent.queries to 24.
  5. Set the maximum pending queries to 50.
    1. In the same location from Step 2 in the Explore view, change he value of max.pending.queries to 50.

If you are unsure of the steps above, are unsure if they are applicable in your environment, or experience any issues, contact RSA Support and quote this article ID for further assistance.


Internal Comments

UserName:shurtj
6/25/2014 2:44:59 PM - Technically Reviewed
Technically reviewed the article and changed its status to Copy Edited. Changed the title and its corresponding Symptom statement to be more descriptive. Modified statements to adhere to Primus best practices. Added Fact statements and applied formatting to the Fix statement.

Evan Pols -- 30 Apr 2024
These settings are now default on newer versions so I'm going to Archive this, however this may still be useful to search for internally in case a scenario is encountered where these values need to be increased even further.

Product Details

RSA Security Analytics
RSA Security Analytics Reporting Engine
RSA Security Analytics Concentrator
RSA Security Analytics Broker
INTERNAL ONLY !!!!

Approval Reviewer Queue

Technical approval queue