Skip to content
  • There are no suggestions because the search field is empty.

The error message 'Unable to fetch schema from the data source' is seen in the Netwitness Reporting Engine after replacing a core appliance

Issue

The error message "Unable to fetch schema from the data source" is seen in the RSA Security Analytics Reporting Engine after replacing a core appliance.

After replacing an RSA Security Analytics Hybrid appliance, the following error messages are seen from within the Reporting Engine:

Unable to fetch schema from the data source
Error occured while connecting to the data source


The following error message is found in the /var/lib/netwitness/uax/logs/sa.log file:  Unable to fetch schema from the datastore

An error message similar to the following is found in the /var/lib/netwitness/uax/logs/sa.log

NOTE:  In the example output above, the IP address referenced in the URL is the old IP address of the hybrid appliance.  A 401 code is a standard HTTP error code for "not found".  Therefore, the message is stating that there is no response to an HTTP GET request on the IP address 192.168.13.196 on port 50106.


Cause

This error message can appear under several other circumstances, such as when a device's IP address changes, when a firewall is blocking communication, or due to other general network failures.  The nature of the error itself is typically physical and simply indicates that the Reporting Engine cannot connect to the device as it is currently referenced by the IP address and port specified in the URL.  In the example above, that would be 192.168.131.196 over port 50106.  In this particular instance, the hybrid IP address was changed to 192.168.131.199 when the new unit was brought online.  The broker picks up the IP address of the device exactly how it is configured.  There is no way to "change" the IP address once it's added as a Data Source, but it can be remedied quite easily by deleting and re-adding the device as a Data Source.


Workaround

The IP address of the hybrid appliance has recently been changed, which may or may not be due to a unit replacement.


Resolution

To remove and re-add a device as a Data Source in the Reporting Engine, follow the steps below.

  1. Log into the Security Analytics UI and navigate to Admin -> Services
  2. Select the Reporting Engine and navigate to View -> Config.
  3. Click on the Sources tab.
  4. Select the device you wish to remove and click on the Minus ( - ) sign, which will remove it from the list.
  5. To re-add the device as a Data Source, click on the Plus ( + ) sign, and click on Available Devices.
  6. Select the device you wish to add and click OK.

If you are unsure of any of the steps above or experience any issues, contact RSA Support and quote this article ID for further assistance.


Internal Comments

UserName:shurtj
6/10/2014 11:00:12 PM - Technically Reviewed
Technically reviewed the article and changed its status to Copy Edited. Modified the title, transitioned the Goal statement to a Symptom statement, and added Fact statements. Cleaned up the formatting of the article in order to abide by Primus best practices, and corrected spelling and grammatical errors.

UserName:mccotl
6/18/2014 5:56:59 AM - Minor Correction
Corrected single typo

Product Details

RSA Product Set: RSA NetWitness Platform
RSA Product/Service Type: Reporting Engine
RSA Version/Condition: 11.x, 12.x
Platform: CentOS 7

Approval Reviewer Queue

Technical approval queue