Skip to content
  • There are no suggestions because the search field is empty.

All licenses displaying expired in RSA Security Analytics 10.6.0.0

Issue

All licenses are showing as unlicensed and the system license ID is showing as unknown. restarting fneserver resolves issue but further investigation shows error with Rabbit and puppet communications. 

Puppet agent -t has the following error: 
 
[root@SA-Server ~]# puppet agent -t
Info: Loading facts
Info: Retrieving pluginfacts
Info: Retrieving plugin
Info: Loading facts
Error: Could not retrieve catalog from remote server: Error 400 on SERVER: Failed when searching for node 6ce79c58-c079-4559-a1bf-321070600e34: Permission denied - /dev/null
Warning: Not using cache on failed catalog
Error: Could not retrieve catalog; skipping run



Performing a service rabbitmq-server status was also having issues with /dev/null permissions.
 
[root@SA-Server ~]# service rabbitmq-server status
/usr/lib/rabbitmq/bin/rabbitmq-env: line 26: /dev/null: Permission denied
/usr/lib/rabbitmq/bin/rabbitmq-env: line 29: /dev/null: Permission denied
Status of node sa@localhost ...
[{pid,2596},



Cause

The /dev/null should have a permissions value of the following >
 [root@SA-Server ~]# ll /dev/null
crw-rw-rw-. 1 root root 1, 3 May 17 11:22 /dev/null

In this case it was touched or damaged causing issues for both Rabbit and Puppet that did not allow puppet to restart the service on the next puppet run that happens every ten minutes.


Resolution

The /dev/null needs to be placed back to the correct permissions , in order to perform this it must be removed and added back in the same line syntax.

 rm -f /dev/null; mknod -m 666 /dev/null c 1 3

Now  /dev/null is back to the correct permissions,

Reset rabbitmq-server and puppetmaster for the next puppet run.

1. service rabbitmq-server restart
2. service puppetmaster restart
3. puppet agent restart

Puppet agent -t now runs fine with the correct results,


Product Details

RSA Product Set: Security Analytics
RSA Product/Service Type: SA Security Analytics UI
RSA Version/Condition: 10.6.0.0
 

Summary

FNE Service was not running and further investigation found that puppet was not restarting fneserver


Approval Reviewer Queue

ASOC Approval Group