Skip to content
  • There are no suggestions because the search field is empty.

Command to increase the polling interval for Health & Wellness on the RSA Security Analytics server

Issue

Because the polling interval is very short by default for the System Monitoring Service (SMS), the RabbitMQ service may crash in certain circumstances.
For more information, refer to the article entitled  RSA Security Analytics UI becomes unavailable because the System Monitoring message queue is full.

The default intervals are shown in the command below.
[root@SA-Server ~]# updatedb && locate --regex ".conf.erb$" | xargs grep "interval"
/etc/puppet/modules/archiver/templates/NwArchiver.conf.erb: interval "10"
/etc/puppet/modules/archiver/templates/NwArchiver.conf.erb: interval "60"
/etc/puppet/modules/broker/templates/NwBroker.conf.erb: interval "5"
/etc/puppet/modules/broker/templates/NwBroker.conf.erb: interval "60"
/etc/puppet/modules/concentrator/templates/NwConcentrator.conf.erb: interval "10"
/etc/puppet/modules/concentrator/templates/NwConcentrator.conf.erb: interval "60"
/etc/puppet/modules/decoder/templates/NwDecoder.conf.erb: interval "10"
/etc/puppet/modules/decoder/templates/NwDecoder.conf.erb: interval "60"
/etc/puppet/modules/ipdbextractor/templates/NwIPDBExtractor.conf.erb: interval "10"
/etc/puppet/modules/ipdbextractor/templates/NwIPDBExtractor.conf.erb: interval "60"
/etc/puppet/modules/logcollector/templates/NwLogCollector.conf.erb: interval "10"
/etc/puppet/modules/logcollector/templates/NwLogCollector.conf.erb: interval "60"
/etc/puppet/modules/logdecoder/templates/NwLogDecoder.conf.erb: interval "10"
/etc/puppet/modules/logdecoder/templates/NwLogDecoder.conf.erb: interval "60"
/etc/puppet/modules/logdecoder/templates/NwLogDecoder_ESM.conf.erb: interval "600"
/etc/puppet/modules/logdecoder/templates/NwLogDecoder_ESM.conf.erb: interval "60"
/etc/puppet/modules/warehouseconnector/templates/NwWarehouseConnector.conf.erb: interval "10"
/etc/puppet/modules/warehouseconnector/templates/NwWarehouseConnector.conf.erb: interval "60"
/etc/puppet/modules/workbench/templates/NwWorkbench.conf.erb: interval "10"
/etc/puppet/modules/workbench/templates/NwWorkbench.conf.erb:# interval "60"

Resolution

The script to update the polling intervals where necessary is listed below.
 
[root@SA-Server ~]# updatedb && for files in $(locate --regex ".conf.erb$");do sed -i 's/interval  "60"/interval  "180"/g' $files; sed -i 's/interval  "10"/interval  "60"/g' $files;done && sed -i 's/interval 60/interval 180/g' /etc/puppet/modules/rsa-sms-server/files/_collectd_java.conf && sed -i 's/interval  "5"/interval  "60"/g' /etc/puppet/modules/broker/templates/NwBroker.conf.erb && service puppet restart
Stopping puppet agent:                                     [  OK  ]
Starting puppet agent:                                     [  OK  ]
 

The output below shows the new polling intervals after the script has been executed.
 
[root@SA-Server ~]# locate --regex ".conf.erb$" | xargs grep "interval"
/etc/puppet/modules/archiver/templates/NwArchiver.conf.erb: interval "60"
/etc/puppet/modules/archiver/templates/NwArchiver.conf.erb: interval "180"
/etc/puppet/modules/broker/templates/NwBroker.conf.erb: interval "180"
/etc/puppet/modules/broker/templates/NwBroker.conf.erb: interval "180"
/etc/puppet/modules/concentrator/templates/NwConcentrator.conf.erb: interval "60"
/etc/puppet/modules/concentrator/templates/NwConcentrator.conf.erb: interval "180"
/etc/puppet/modules/decoder/templates/NwDecoder.conf.erb: interval "60"
/etc/puppet/modules/decoder/templates/NwDecoder.conf.erb: interval "180"
/etc/puppet/modules/ipdbextractor/templates/NwIPDBExtractor.conf.erb: interval "60"
/etc/puppet/modules/ipdbextractor/templates/NwIPDBExtractor.conf.erb: interval "180"
/etc/puppet/modules/logcollector/templates/NwLogCollector.conf.erb: interval "60"
/etc/puppet/modules/logcollector/templates/NwLogCollector.conf.erb: interval "180"
/etc/puppet/modules/logdecoder/templates/NwLogDecoder.conf.erb: interval "60"
/etc/puppet/modules/logdecoder/templates/NwLogDecoder.conf.erb: interval "180"
/etc/puppet/modules/logdecoder/templates/NwLogDecoder_ESM.conf.erb: interval "600"
/etc/puppet/modules/logdecoder/templates/NwLogDecoder_ESM.conf.erb: interval "180"
/etc/puppet/modules/warehouseconnector/templates/NwWarehouseConnector.conf.erb: interval "60"
/etc/puppet/modules/warehouseconnector/templates/NwWarehouseConnector.conf.erb: interval "180"
/etc/puppet/modules/workbench/templates/NwWorkbench.conf.erb: interval "60"
/etc/puppet/modules/workbench/templates/NwWorkbench.conf.erb:# interval "180"

[root@rsaaio ~]# cat /etc/puppet/modules/rsa-sms-server/files/_collectd_java.conf | grep interval
interval 180

Product Details

RSA Product Set: Security Analytics
RSA Product/Service Type: Security Analytics Server, Health & Wellness
RSA Version/Condition: 10.4.x, 10.5.x
Platform: CentOS
O/S Version: EL6

Approval Reviewer Queue

Technical approval queue