Issue with user interface availability on an All-in-One during RSA Security Analytics 10.6.0.0 to 10.6.4.0 upgrade
Issue
When you update RSA Security Analytics from 10.6.0.0 to 10.6.4.0, the RSA Security Analytics UI becomes unavailable.
Cause
The RSA Security Analytics UI becomes unavailable due to a jettysrv dependency in both the rsa-sms and rabbitmq-server services. The rsa-sms service is also dependent on the rabbitmq-server service.The error below is found in the /var/lib/netwitness/uax/logs/sa.log file.
2016-09-08 11:57:04,550 [Appliance cache Updater 1436286190] ERROR com.rsa.smc.sa.core.util.carlos.ApplianceServiceCarlosMessageProcessor - Fcom.rsa.netwitness.carlos.transport.TransportException:
java.net.ConnectException: Connection refused
at com.rsa.netwitness.carlos.transport.spi.AbstractMessageDestination.doStart(AbstractMessageDestination.java:178)
at com.rsa.netwitness.carlos.transport.spi.AbstractMessageEndpoint.start(AbstractMessageEndpoint.java:100)
at ailed to send request to System Management Service, possible reason Cannot connect to RabbitMQ Service
com.rsa.netwitness.carlos.transport.TransportException: com.rsa.netwitness.carlos.transport.TransportException: com.rsa.netwitness.carlos.transport.TransportException: java.net.ConnectException: Connection refused
at com.rsa.netwitness.carlos.transport.spi.AbstractMessageDestination.doStart(AbstractMessageDestination.java:178)
at com.rsa.netwitness.carlos.transport.spi.AbstractMessageEndpoint.start(AbstractMessageEndpoint.java:100)
at ailed to send request to System Management Service, possible reason Cannot connect to RabbitMQ Service
com.rsa.netwitness.carlos.transport.TransportException: com.rsa.netwitness.carlos.transport.TransportException: com.rsa.netwitness.carlos.transport.TransportException: java.net.ConnectException: Connection refused
Workaround
Execute the following command once you initiate an update:
puppet agent -t
The above command should restart any stopped services such as rabbitmq-server or rsa-sms.
If issues persist then further troubleshooting will need to be performed on the rabbitmq-server service.
Resolution
RSA Security Analytics AIO devices are no longer supported beginning in RSA NetWitess 11. If this issue has occurred in 10.6.x the workaround is recommended.If you are experiencing this issue and still need assistance, contact RSA Customer Support and quote this article number.
Notes
The following line in /etc/init/jettysrv.conf shows the dependencies of jettysrv:
if [[ `/sbin/service rabbitmq-server status | grep -i 'running_applications'` && `/sbin/service tokumx status | grep -i 'run'` ]] && ! [[ `/sbin/service rsa-sms status | grep -i -E 'not[[:space:]]+run'` ]]
The dependencies are:
- rabbitmq-server
- tokumx
- rsa-sms
Product Details
RSA Product Set: NetWitness Logs & Network, Security AnalyticsRSA Product/Service Type: Security Analytics UI, All-In-One (AIO) Appliance
RSA Version/Condition: 10.6.0.0, 10.6.4.X
Platform: CentOS
O/S Version: EL6
Summary
Installation and Update Issue.
Approval Reviewer Queue
RSA NetWitness Suite Approval Queue