Constant MessageBrokerLogReceiver errors on Appliance in RSA Security Analytics 10.5+

Issue

Constantly seeing the error message below in /var/log/messages:
 

Cause

Few Factors can cause the invalidity of the CA certificate:

1- Invalid CA certificates between Local LogCollector and LogDecoder 
2- Invalid CA certificates between SA server and Core Appliance

Resolution

The Invalid CA certificates can be resolved by re-provisioning the appliance , which will also ensure the correct exchange of CA certs between SA server and the core services. 

However, in rare circumstances, when the Hosts are removed from the UI, few RabbitMQ components are not removed , hence causing the above error. 

Attemp1:

Refer to KB 000030165 for resetting puppet certificates and reprovisioning the Host

Attemp1:

If attempt 1 did not work and the above error still present, then we will need to verify the redundant component in RabbitMQ that is still causing the above error. Here is how to do :

1- ssh to SA server

2- run the command and note the results returned:
   
Example:
 
- Then we get the output below :
​

    b- The above redundant entries in RabbitMQ are the root cause of the error seen above

    c- run the command below to removed them:
Example:
          

The CA certificate error should have now been cleared

Product Details

RSA Product Set: Security Analytics
RSA Product/Service Type: SA Core Appliance
RSA Version/Condition: 10.5+

Approval Reviewer Queue

ASOC Approval Group