Skip to content
  • There are no suggestions because the search field is empty.

RSA NetWitness Platform Collector PUSH or PULL configuration shows Shovel Failed error

Issue

NetWitness Remote Collector Push method shows "shovel failed" error as below.

shov

/var/log/messages
Feb 13 10:57:01 VLC NwLogCollector[891]: [MessageBrokerLogReceiver] [failure] error 2020-02-13T10.57.01Z nw_shovel_worker:init failed: error With reason: {badmatch, {error, {badmatch,{error,closed}}}}! Retrying in 30 seconds.

Cause

This is due to certificate mismatch for LC and VLC communication.


Resolution

Follow the below instructions to fix the shovel error.
  1. Download /etc/rabbitmq/ssl/truststore.pem file from either working VLC or LC using WinSCP.
  2. Take backup of /etc/pki/nw/trust/truststore.pem from nonworking VLC.
  3. Upload the truststore.pem file used in Step1 to /etc/pki/nw/trust/truststore.pem in nonworking VLC.
  4. Run below commands to create soft link.
    cd /etc/rabbitmq/ssl
    ln -s /etc/pki/nw/trust/truststore.pem truststore.pem
  5. Verify that the soft link should be as below.
    cd /etc/rabbitmq/ssl
    ls -l
    lrwxrwxrwx. 1 root root 32 Aug 14 2019 truststore.pem -> /etc/pki/nw/trust/truststore.pem
      
  6. Login to GUI and go to VLC->Config->Local Collectors page to see no errors.

Product Details

RSA Product Set: RSA NetWitness Platform
RSA Product/Service Type: Core Appliance
RSA Version/Condition: 11.2.0.0
Platform: CentOS
O/S Version: 7

Summary

This document outlines the procedure to fix shovel failed error for PUSH or PULL configuration.


Approval Reviewer Queue

RSA NetWitness Suite Approval Queue