Skip to content
  • There are no suggestions because the search field is empty.

Error message An error occurred creating an AMQP Channel from collectd in NetWitness 10.4.1 and above

Issue

An error similar to that shown below appears in /var/log/messages on the Security Analytics Server or Core Appliance.
While these errors are benign, there are many of them, making it difficult to sort what is an actual failure and what is not a failure in collectd.
 
Mar 29 18:35:38 sa-server collectd[32133]: An error occurred publishing a statistic for plugin c21188e2-b261-456f-8cd7-a1ea902925f5/sa_processinfo-string-service_status. Error: An error occurred publishing an AMQP Message. Exchange name: carlos.sms.collectd; error: An error occurred creating an AMQP Channel. Configuration: {#012 "urn": "carlos.sms.collectd",#012 "connection":#012
{#012 "vhost": "\/rsa\/system"#012 }



Cause

This issue has been identified as incorrectly spelled plugin names in the /etc/puppet/modules/rabbitmq/manifests/init.pp configuration file.


Resolution

Before beginning, download the init.pp file provided in the attachments section of this article and scp the file to the SA server.  This configuration file is managed by puppet, and propagated to each core device from the SA server.  This example uses the /tmp directory as the initial scp location for the new init.pp file.  These commands are to be run from an ssh terminal window using the root credentials.

To resolve the issue, follow the steps below.
  1. On the SA server, make a backup copy of the existing  /etc/puppet/modules/rabbitmq/manifests  file.
    cd /etc/puppet/modules/rabbitmq/manifests
    cp init.pp /root/init.pp.orig.<todaysDate>
  2. Replace the current init.pp file in /etc/puppet/modules/rabbitmq/manifests with the new file from this article.
    cp /tmp/init.pp /etc/puppet/modules/rabbitmq/manifests/init.pp
    Note: You will be prompted to overwrite the existing file and must say yes to this prompt.
  3. On the SA server, restart the puppetmaster process.
    service puppetmaster restart
  4. On the SA server, restart the puppet process.
    service puppet restart
  5. On the SA server, restart the rabbitmq process.
    service rabbitmq-server restart
  6. On every affected core device communicating with the SA server, (concentrators and decoders), run the following command to propagate the new init.pp file to the device.
    puppet agent –t

If you are unsure of any of the steps above or experience any issues, contact RSA Support and quote this article number for further assistance.

Product Details

RSA Product Set: Security Analytics, NetWitness
RSA Product/Service Type: Decoder, Log Decoder, Concentrator, Hybrid, Broker, Security Analytics Server
RSA Version/Condition: 10.4.1.x, 10.5.x
Platform: CentOS
Platform (Other): collectd
O/S Version: EL5 / EL6

Summary

This article provides troubleshooting information on the specific rabbitmq error listed in the title of this document.


Approval Reviewer Queue

Technical approval queue