Rabbitmq-server unable to start in RSA NetWitness Logs & Network

Issue

VLC Rabbitmq service not starting

Reviewing of sa@localhost.log shows the following error:

 Error description:
 
   {could_not_start,nw_admin,
 
       ,
 
                 [{nw_cert_monitor,load_certificate,1,
 
                      [{file,
 
                           "/home/sabuild/workspace/ngc-10.6.x-linux-stability-build-git/src/NwLogCollection/nw_admin/nw_cert_monitor.erl"},
 
                       {line,72}]},
 
                  {nw_cert_monitor,init,1,
 
                      [{file,
 
                           "/home/sabuild/workspace/ngc-10.6.x-linux-stability-build-git/src/NwLogCollection/nw_admin/nw_cert_monitor.erl"},
 
                       {line,48}]},
 
                  {nw_admin_worker,init,1,
 
                      [{file,
 
                           "/home/sabuild/workspace/ngc-10.6.x-linux-stability-build-git/src/NwLogCollection/nw_admin/nw_admin_worker.erl"},
 
                       {line,32}]},
 
                  {gen_server,init_it,6,[{file,"gen_server.erl"},{line,304}]},
 
                  {proc_lib,init_p_do_apply,3,
 
                      [{file,"proc_lib.erl"},{line,239}]}]}}},
 
        {nw_admin,start,[normal,[]]}}}

Resolution

Backup /etc/rabbitmq/rsa_enabled_plugins to any directory
Review /etc/rabbitmq/rsa_enabled_plugins, you should the lines below.

[root@PSBDC-RSA-DEC rabbitmq]# cat /etc/rabbitmq/rsa_enabled_plugins
[nw_admin,rabbitmq_auth_mechanism_ssl,rabbitmq_federation,rabbitmq_federation_management,rabbitmq_management,rabbitmq_stomp]

Edit /etc/rabbitmq/rsa_enabled_plugins and remove nw_admin.
Save the changes done on /etc/rabbitmq/rsa_enabled_plugins
You should be able to start rabbitmq-server services after the changes done.

Notes

Upon review of VLC /var/log/messages we can see that events are being received by the VLC.

Jun 10 12:18:10 A3605SNCSVLCV01 NwLogCollector[2349]: [WindowsCollection] [info] [Windows.s3605sncscshv01_schools_moe_edu_sg] Got 77 events
Jun 10 12:18:11 A3605SNCSVLCV01 NwLogCollector[2349]: [WindowsCollection] [info] [Windows.s3605sncscshv01_schools_moe_edu_sg] Got 76 events
Jun 10 12:18:11 A3605SNCSVLCV01 NwLogCollector[2349]: [WindowsCollection] [info] [Windows.s3605sncscdcv01_schools_moe_edu_sg] Got 41 events

This tells us that VLC is now working fine.

Product Details

RSA Product Set: NetWitness Logs & Network
RSA Product/Service Type: Security Analytics Server
RSA Version/Condition: 10.6.6.0

Approval Reviewer Queue

RSA NetWitness Suite Approval Queue