Getting LogCollector Event Processor Queue with No Consumers alarms in Health and Wellness page after RSA NetWitness upgrade

Issue

After upgrading the NetWitness environment, the log hybrid or log decoder came back online with the following alarm "LogCollector Event Processor Queue with No Consumers" in Health and Wellness.

Cause

This issue occurs because the configuration under Event Destinations is stopped. The Event Destinations tab of the Log collector service > Config view shows the destination of event data collected by the Log Collector. Ensure that the status is started to ensure data flow. 

Resolution

1. Check the free space for NetWitness partition by running the df -h command to ensure that the issue alarm is not caused by any filesystem errors.
2. Check if rabbitmq-server service is running.
   systemctl status rabbitmq-server
3. Check rabbitmq queues.
   rabbitmqctl list_queues -p logcollection consumers name messages
4. Check if Log Collector and Log Decoder services are running:
   systemctl status nwlogdecoder
   systemctl status nwlogcollector
5. Go to Admin > Services > Log Collection service. 
6. Select actions menu   > View > Config to display the Log Collection configuration then click the Event Destinations tab.
7. In the Select Event Destinations drop-down menu, select Log Decoder. 
8. Select the configured Log Decoder service from the Destination Groups dialog.
9. Ensure that the service is showing started under the Status column. 
       

Product Details

RSA Product Set: RSA NetWitness Platform
RSA Product/Service Type: Remote Log Collector, Log Collector, Log Hybrid
RSA Version/Condition: 11.x

Summary

After upgrading the NetWitness environment, the log hybrid or log decoder came back online with the following alarm LogCollector Event Processor Queue with No Consumers in Health and Wellness.

Approval Reviewer Queue

RSA NetWitness Suite Approval Queue