/var/lib/rabbitmq is 100% full on the RSA Security Analytics server

Issue

/var/lib/rabbitmq is 100% full on SA server,

Cause

This is caused by too many rdq files accumulating in the rabbitmq directory. These are the rdq stat files.
They are generally of no interest to the customer.

Resolution

You may safely delete the rdq files on the Security Analytics server.

 rm -f /var/netwitness/rabbitmq/mnesia/sa@localhost/msg_store_persistent/*
 
rm -f /var/netwitness/rabbitmq/mnesia/sa@localhost/msg_store_transient/*

On the Security Analytics Server –
1) Edit /etc/puppet/modules/X/templates/NwX.conf.erb (X=broker, decoder, logdecoder, concentrator....)
change the first interval "10" to "60" and the second internval from "60" to "180"

This is example is from a decoder.
/etc/puppet/modules/decoder/templates/NwDecoder.conf.erb

Change "10" to "60"

  <Module "NgNativeReader" "NwDecoder-FastUpdate">
  
        port      "56004"
  
        ssl       "yes"
  
        keypath   "/var/lib/puppet/ssl/private_keys/<%=@node_id%>.pem"
  
        certpath  "/var/lib/puppet/ssl/certs/<%=@node_id%>.pem"
  
        interval  "10"

Change "60" to "180"

  <Module "NgNativeReader" "NwDecoder-NormalUpdate">
  
        port      "56004"
  
        ssl       "yes"
  
        keypath   "/var/lib/puppet/ssl/private_keys/<%=@node_id%>.pem"
  
        certpath  "/var/lib/puppet/ssl/certs/<%=@node_id%>.pem"
  
        interval  "60"

Save the file.

2) Edit /etc/puppet/modules/rsa-sms-server/files/_collectd_java.conf
change interval from 60 to 180 as well.

3) Restart the puppet service.

  service puppet restart
 

4) Restart the rabbitmq-server service.

  service rabbitmq-server restart
 

Monitor to see how much the interval decreases.

Product Details

RSA Product Set: Security Analytics
RSA Product/Service Type: Security Analytics Server
RSA Version/Condition: 10.4.x, 10.5.x
Platform: CentOS
O/S Version: EL6

Summary

/var/lib/rabbitmq is full on SA server.

Approval Reviewer Queue

ASOC Approval Group