Skip to content
  • There are no suggestions because the search field is empty.

There are no stats for some hosts in Health & Wellness in RSA NetWitness Platform

Issue

There are no stats for some hosts in Health & Wellness.

Cause

The RabbitMQ federation links might not be properly configured.

Resolution

Follow these steps:
  1. SSH the affected host and run the command: 

         10.6.x:
    facter -p node_id

         11.x:
    cat /etc/salt/minion

         Take note of the node ID.
     
  2. SSH the SA/NW Server and run the command: 
    rabbitmqctl list_parameters -p /rsa/system
    Check if there are any entries with the correct node ID and IP Address of the affected host.
     
  3.  If the node ID or IP Address is not correct, then you can:
    1. Change the federation entry running these commands:       
       
      First command:
      rabbitmqctl -q clear_parameter -p /rsa/system federation-upstream carlos-upstream-<WRONG_NODEID>
           Example: 
      rabbitmqctl -q clear_parameter -p /rsa/system federation-upstream carlos-upstream-1d8aa9ec-8471-439d-87d9-9c645a0b3337
           Second command:
      rabbitmqctl set_parameter -p /rsa/system federation-upstream carlos-upstream-<CORRECT_NODEID> "{\"uri\": \"amqps://<CORRECT_IP>:5671?auth_mechanism=external\",\"expires\": 3600000}"
           Example: 
      rabbitmqctl set_parameter -p /rsa/system federation-upstream carlos-upstream-1d8aa9ec-8471-439d-87d9-9c645a0b3337 "{\"uri\": \"amqps://192.168.129.214:5671?auth_mechanism=external\",\"expires\": 3600000}"
  4. If the node ID and IP Address are correct, then try restarting the collect and rabbitmq services in the host: 
    service rabbitmq-server restart
    service collectd restart

    ​​​​
  5.  Also, run rabbitmqctl list_queues -p /rsa/system to see federations created.
sample output:
Listing queues ...
federation: carlos.audit -> sa@NWAPPLIANCE4309 0
federation: carlos.esm.eventsource.changes -> sa@NWAPPLIANCE4309 0
federation: carlos.sms.collectd -> sa@NWAPPLIANCE4309 0
 
       6. Verify GUI ADMIN->Health & Wellness page to see the latest stats from problematic host.

Notes

If the following command shows some/all queues missing on the host, please follow the steps below to resolve the issue.
rabbitmqctl list_queues -p /rsa/system
  1. Note the NODEID from the affected host.
    cat /etc/salt/minion
  2. Clear parameter of the host from the Admin Server.
    SSH to the Admin server.
    rabbitmqctl list_parameters -p /rsa/system (confirm the entry)
    rabbitmqctl -q clear_parameter -p /rsa/system federation-upstream carlos-upstream-<NODEID> (run this command even if the current entry appears with the correct NODEID and IP of the host.)
  3. Remove and re-add the host.
    SSH to the Admin server.
    orchestration-cli-client --remove-key <NODEID>
    orchestration-cli-client --accept-key <NODEID>
    orchestration-cli-client -i -o <NODEID> -c <Category_Name> -b <IP_AdminServer> (refer to https://community.rsa.com/docs/DOC-84671)
  4. Confirm the status from the host.
    rabbitmqctl list_queues -p /rsa/system
    The following is an example of an expected results.
    # rabbitmqctl list_queues -p /rsa/system
    Listing queues
    federation: carlos.audit -> rabbit@NWSRV 0
    federation: carlos.alerts -> rabbit@NWSRV 0
    federation: carlos.sms.collectd -> rabbit@NWSRV 0
    federation: carlos.esm.eventsource.changes -> rabbit@NWSRV 0




     

Product Details

RSA Product Set: NetWitness Platform
RSA Product/Service Type: All hosts
RSA Version/Condition: 10.6.x / 11.x

Approval Reviewer Queue

RSA NetWitness Suite Approval Queue