ESA MongoDB Error

[Anonymous]

Getting following error constantly on ESA which stops us from showing alerts:

2016-03-01 09:35:25,175 [provider{type=EXTENSION_1, id=extension_1, maxDispatch=0, windowSize=60, maxQueue=0}] WARN com.rsa.netwitness.carlos.notification.base.Provider - A notification for extension_1 could not be sent. Reason: java.lang.RuntimeException: Mongo database connection to mongodb://localhost:27017/esa failed: IOException authenticating the connection; nested exception is com.mongodb.MongoException$Network: IOException authenticating the connection;    at com.rsa.netwitness.core.alert.config.MongoStorageConfiguration.getMongoTemplate(MongoStorageConfiguration.java:93);     at com.rsa.netwitness.core.alert.config.MongoStorageConfiguration.getAlertCollection(MongoStorageConfiguration.java:160);     at com.rsa.netwitness.core.epl.StorageProvider.send(StorageProvider.java:83);     at com.rsa.netwitness.carlos.notification.base.Provider.run(Provider.java:184); at java.lang.Thread.run(Thread.java:745);

[DavidWaugh1 · Accepted solution]

This indicates that the tokumx service might not be started.

Try netstat -na |grep 27017 on the ESA service

Try service tokumx restart

A common cause is if you have some bad rules and have filled up your tokumx database with lots of alerts. This is where Pablo Trigo's esaclient can help you out.

[Anonymous]

Thanks for sharing esatool. tokumx was behaving abnormally. There were lot of rules enabled, which might be causing this. Have cut down enabled rules to 30 and checking performance. Will monitor and see how it goes before I enable more rules.