Skip to content
  • There are no suggestions because the search field is empty.

Issue with user interface availability on an All-in-One during RSA Security Analytics 10.6.0.0 to 10.6.4.0 upgrade

Issue

When you update RSA Security Analytics from 10.6.0.0 to 10.6.4.0, the RSA Security Analytics UI becomes unavailable.


Cause

The RSA Security Analytics UI becomes unavailable due to a jettysrv dependency in both the rsa-sms and rabbitmq-server services.  The rsa-sms service is also dependent on the rabbitmq-server service.

The error below is found in the /var/lib/netwitness/uax/logs/sa.log file.
2016-09-08 11:57:04,550 [Appliance cache Updater 1436286190] ERROR com.rsa.smc.sa.core.util.carlos.ApplianceServiceCarlosMessageProcessor - Fcom.rsa.netwitness.carlos.transport.TransportException: java.net.ConnectException: Connection refused
at com.rsa.netwitness.carlos.transport.spi.AbstractMessageDestination.doStart(AbstractMessageDestination.java:178)
at com.rsa.netwitness.carlos.transport.spi.AbstractMessageEndpoint.start(AbstractMessageEndpoint.java:100)
at ailed to send request to System Management Service, possible reason Cannot connect to RabbitMQ Service
com.rsa.netwitness.carlos.transport.TransportException: com.rsa.netwitness.carlos.transport.TransportException: com.rsa.netwitness.carlos.transport.TransportException: java.net.ConnectException: Connection refused



Workaround

Execute the following command once you initiate an update:
puppet agent -t
The above command should restart any stopped services such as rabbitmq-server or rsa-sms.

If issues persist then further troubleshooting will need to be performed on the rabbitmq-server service.

Resolution

RSA Security Analytics AIO devices are no longer supported beginning in RSA NetWitess 11. If this issue has occurred in 10.6.x the workaround is recommended.
If you are experiencing this issue and still need assistance, contact RSA Customer Support and quote this article number.

Notes

The following line in /etc/init/jettysrv.conf shows the dependencies of jettysrv:
if [[ `/sbin/service rabbitmq-server status | grep -i 'running_applications'` && `/sbin/service tokumx status | grep -i 'run'` ]] && ! [[ `/sbin/service rsa-sms status | grep -i -E 'not[[:space:]]+run'` ]]
The dependencies are:
  • rabbitmq-server
  • tokumx
  • rsa-sms

Product Details

RSA Product Set: NetWitness Logs & Network, Security Analytics
RSA Product/Service Type: Security Analytics UI, All-In-One (AIO) Appliance
RSA Version/Condition: 10.6.0.0, 10.6.4.X
Platform: CentOS
O/S Version: EL6

Summary

Installation and Update Issue.


Approval Reviewer Queue

RSA NetWitness Suite Approval Queue