How to determine if Host unreachable is a false positive alert in RSA NetWitness Platform 11.x

Issue

Column 1: In Health and Wellness on the Alarms tab, a host unreachable alert is seen

However test connection is successful and service is up in UI:

Cause

Federation queue might not have migrated correctly after an upgrade from 10.6 or collectd service down.

Collectd status.
Collectd federation queue missing on the host.

[root@BLRCSVLC ~]# rabbitmqctl list_queues -p /rsa/system name consumers messages
Listing queues
federation: carlos.audit -> rabbit@BLRCSAdmin 1 0
[root@BLRCSVLC ~]#

Missing queue: federation: carlos.sms.collectd

Resolution

Restart rabbitmq and collectd services.

service collectd restart
service rabbitmq-server restart

Check if the queue is created after restarting the service:

If we are still not seeing carlos queue in the "rabbitmqctl list_queues" then re-add the host using the below KB:

https://community.rsa.com/docs/DOC-84671

If you are unsure about any of the steps above kindly contact RSA support.

Product Details

Column 1: RSA Product Set: RSA NetWitness Platform
RSA Product/Service Type: Security Analytics UI, Health and Wellness
RSA Version/Condition: 11.x
Platform: CentOS
O/S Version: 7

Approval Reviewer Queue

RSA NetWitness Suite Approval Queue