How to delete a specific service from a node in MongoDB on the RSA Security Analytics server

Issue

After issuing the db.nodes.find() command within the puppet MongoDB instance, output similar to the example below is displayed for a specific node.
 
This article will explain how to remove a service from a node, being the  logcollector service in this example.

Resolution

In order to remove a service from a node using the puppet MongoDB instance, follow the steps below.

1. Connect to the appliance in question via SSH as the root user.
2. Issue the command cat /var/lib/puppet/node_id which will provide the Node ID of the appliance.  (i.e. 545aa67gui19311efe523695)
3. Use the addService.py script to re-specify the services that should be included on the appliance, excluding the service you wish to remove.  This is shown in the example below.
   /etc/puppet/scripts/addService.py 545aa67gui19311efe523695 concentrator,base,appliance
4. Connect to the Security Analytics server via SSH as the root user.
5. Issue the two commands below to restart the puppetmaster and rabbitmq-server services.
   service rabbitmq-server restart
   service puppetmaster restart
6. Return to the SSH session for the other appliance and issue the puppet agent -t command to synchronize the changes with the Security Analytics server.

After performing these steps, the service should have been removed successfully.

Product Details

RSA Product Set: Security Analytics
RSA Product/Service Type: Security Analytics Server
RSA Version/Condition: 10.4.x
Platform: CentOS
Platform (Other): Puppet, MongoDB
O/S Version: EL6

Summary

How to delete a specific service from a node from the MongoDB, for example if a node was provisioned by mistake or the Appliance get re-purposed.

Approval Reviewer Queue

ASOC Approval Group