i am not able to add reporting engine in security analytics

[Anonymous]

i am currently working on Virtual Testing Environment of RSA Security Analytics. I have successfully deployed all components(SA server, Concentrator, Decoder and Log Decoder) VM in our Esxi Server. All the components are licensed and active and also working properly. But i have an issue with Reporting Engine whenever i tried to add device Reporting Engine and check test connection, it shows test connection failed and i am not able to add Reporting engine in the Devices.

            IP address detail: Example

            SA server: 192.168.1.129/24

            Concentrator: 192.168.1.88/24

            Decoder: 192.168.1.168/24

            Log Decoder: 192.168.1.49/24

          I am trying to add Reporting Engine on 192.168.1.129 or 127.0.0.1 but its failed on both cases. I have also tried to add Reporting Engine      

          After redeployment of all VMs and got the same error. Please find the attached Screen shot of the error.

Please help on this issue.

Thanks in advance

[RSAAdmin]

We had the same issue yesterday with Reporting Engine on a new 10.3 install,

Service rsasoc_re started and listening on 51113, but unable to add the device using web interface (127.0.0.1 or localhost)

another laptop on the same screen, with the same value (localhost) on the same time could Test Connection and correctly add the device ?!?

I think we just need to be patient

[Anonymous]

I have new (reimage) SA server. Have installed re-server 10.3.3 package, but can't add to reporting engine via Web UI. Port 51113 listened. I don't understand where a problem.

2014-05-14 13:29:05,481 [main] INFO  com.rsa.netwitness.carlos.server.context.CarlosContextListener - Home directory located at  /home/rsasoc/rsa/soc/reporting-engine

2014-05-14 13:29:05,529 [main] INFO  com.rsa.netwitness.carlos.server.context.CarlosContextListener - Carlos Database directory located at  null

2014-05-14 13:29:17,148 [main] INFO  com.rsa.soc.re.contentstore.jcr.JCRContentStore - Init repository starting

2014-05-14 13:29:18,209 [main] INFO  com.rsa.soc.re.contentstore.jcr.JCRContentStore - Adding root package

2014-05-14 13:29:18,258 [main] INFO  com.rsa.soc.re.contentstore.jcr.JCRContentStore - Checking for node type :  REPORT

2014-05-14 13:29:18,259 [main] INFO  com.rsa.soc.re.contentstore.jcr.JCRContentStore - Node type already exists :  REPORT

2014-05-14 13:29:18,260 [main] INFO  com.rsa.soc.re.contentstore.jcr.JCRContentStore - Checking for node type :  REPORTGROUP

2014-05-14 13:29:18,261 [main] INFO  com.rsa.soc.re.contentstore.jcr.JCRContentStore - Node type already exists :  REPORTGROUP

2014-05-14 13:29:18,261 [main] INFO  com.rsa.soc.re.contentstore.jcr.JCRContentStore - Checking for node type :  RULE

2014-05-14 13:29:18,262 [main] INFO  com.rsa.soc.re.contentstore.jcr.JCRContentStore - Node type already exists :  RULE

2014-05-14 13:29:18,262 [main] INFO  com.rsa.soc.re.contentstore.jcr.JCRContentStore - Checking for node type :  RULEGROUP

2014-05-14 13:29:18,263 [main] INFO  com.rsa.soc.re.contentstore.jcr.JCRContentStore - Node type already exists :  RULEGROUP

2014-05-14 13:29:18,263 [main] INFO  com.rsa.soc.re.contentstore.jcr.JCRContentStore - Checking for node type :  RUNDEF

2014-05-14 13:29:18,264 [main] INFO  com.rsa.soc.re.contentstore.jcr.JCRContentStore - Node type already exists :  RUNDEF

2014-05-14 13:29:18,264 [main] INFO  com.rsa.soc.re.contentstore.jcr.JCRContentStore - Checking for node type :  RUNGROUP

2014-05-14 13:29:18,266 [main] INFO  com.rsa.soc.re.contentstore.jcr.JCRContentStore - Node type already exists :  RUNGROUP

2014-05-14 13:29:18,266 [main] INFO  com.rsa.soc.re.contentstore.jcr.JCRContentStore - Checking for node type :  TEMPLATE

2014-05-14 13:29:18,267 [main] INFO  com.rsa.soc.re.contentstore.jcr.JCRContentStore - Node type already exists :  TEMPLATE

2014-05-14 13:29:18,267 [main] INFO  com.rsa.soc.re.contentstore.jcr.JCRContentStore - Checking for node type :  LIST

2014-05-14 13:29:18,268 [main] INFO  com.rsa.soc.re.contentstore.jcr.JCRContentStore - Node type already exists :  LIST

2014-05-14 13:29:18,268 [main] INFO  com.rsa.soc.re.contentstore.jcr.JCRContentStore - Checking for node type :  LISTGROUP

2014-05-14 13:29:18,269 [main] INFO  com.rsa.soc.re.contentstore.jcr.JCRContentStore - Node type already exists :  LISTGROUP

2014-05-14 13:29:18,269 [main] INFO  com.rsa.soc.re.contentstore.jcr.JCRContentStore - Checking for node type :  ALERT

2014-05-14 13:29:18,271 [main] INFO  com.rsa.soc.re.contentstore.jcr.JCRContentStore - Node type already exists :  ALERT

2014-05-14 13:29:18,271 [main] INFO  com.rsa.soc.re.contentstore.jcr.JCRContentStore - Checking for node type :  CHART

2014-05-14 13:29:18,272 [main] INFO  com.rsa.soc.re.contentstore.jcr.JCRContentStore - Node type already exists :  CHART

2014-05-14 13:29:18,272 [main] INFO  com.rsa.soc.re.contentstore.jcr.JCRContentStore - Checking for node type :  CHARTGROUP

2014-05-14 13:29:18,273 [main] INFO  com.rsa.soc.re.contentstore.jcr.JCRContentStore - Node type already exists :  CHARTGROUP

2014-05-14 13:29:18,299 [main] INFO  com.rsa.soc.re.contentstore.jcr.JCRContentStore - Init repository completed.

2014-05-14 13:29:18,392 [main] INFO  com.rsa.soc.re.contentstore.jcr.JCRContentStore - Init repository starting

2014-05-14 13:29:18,392 [main] INFO  com.rsa.soc.re.contentstore.jcr.JCRContentStore - Adding root package

2014-05-14 13:29:18,394 [main] INFO  com.rsa.soc.re.contentstore.jcr.JCRContentStore - Checking for node type :  REPORT

2014-05-14 13:29:18,394 [main] INFO  com.rsa.soc.re.contentstore.jcr.JCRContentStore - Node type already exists :  REPORT

2014-05-14 13:29:18,395 [main] INFO  com.rsa.soc.re.contentstore.jcr.JCRContentStore - Checking for node type :  REPORTGROUP

2014-05-14 13:29:18,395 [main] INFO  com.rsa.soc.re.contentstore.jcr.JCRContentStore - Node type already exists :  REPORTGROUP

2014-05-14 13:29:18,396 [main] INFO  com.rsa.soc.re.contentstore.jcr.JCRContentStore - Checking for node type :  RULE

2014-05-14 13:29:18,396 [main] INFO  com.rsa.soc.re.contentstore.jcr.JCRContentStore - Node type already exists :  RULE

2014-05-14 13:29:18,396 [main] INFO  com.rsa.soc.re.contentstore.jcr.JCRContentStore - Checking for node type :  RULEGROUP

2014-05-14 13:29:18,397 [main] INFO  com.rsa.soc.re.contentstore.jcr.JCRContentStore - Node type already exists :  RULEGROUP

2014-05-14 13:29:18,397 [main] INFO  com.rsa.soc.re.contentstore.jcr.JCRContentStore - Checking for node type :  RUNDEF

2014-05-14 13:29:18,398 [main] INFO  com.rsa.soc.re.contentstore.jcr.JCRContentStore - Node type already exists :  RUNDEF

2014-05-14 13:29:18,398 [main] INFO  com.rsa.soc.re.contentstore.jcr.JCRContentStore - Checking for node type :  RUNGROUP

2014-05-14 13:29:18,399 [main] INFO  com.rsa.soc.re.contentstore.jcr.JCRContentStore - Node type already exists :  RUNGROUP

2014-05-14 13:29:18,399 [main] INFO  com.rsa.soc.re.contentstore.jcr.JCRContentStore - Checking for node type :  TEMPLATE

2014-05-14 13:29:18,400 [main] INFO  com.rsa.soc.re.contentstore.jcr.JCRContentStore - Node type already exists :  TEMPLATE

2014-05-14 13:29:18,400 [main] INFO  com.rsa.soc.re.contentstore.jcr.JCRContentStore - Checking for node type :  LIST

2014-05-14 13:29:18,400 [main] INFO  com.rsa.soc.re.contentstore.jcr.JCRContentStore - Node type already exists :  LIST

2014-05-14 13:29:18,401 [main] INFO  com.rsa.soc.re.contentstore.jcr.JCRContentStore - Checking for node type :  LISTGROUP

2014-05-14 13:29:18,401 [main] INFO  com.rsa.soc.re.contentstore.jcr.JCRContentStore - Node type already exists :  LISTGROUP

2014-05-14 13:29:18,402 [main] INFO  com.rsa.soc.re.contentstore.jcr.JCRContentStore - Checking for node type :  ALERT

2014-05-14 13:29:18,402 [main] INFO  com.rsa.soc.re.contentstore.jcr.JCRContentStore - Node type already exists :  ALERT

2014-05-14 13:29:18,402 [main] INFO  com.rsa.soc.re.contentstore.jcr.JCRContentStore - Checking for node type :  CHART

2014-05-14 13:29:18,402 [main] INFO  com.rsa.soc.re.contentstore.jcr.JCRContentStore - Node type already exists :  CHART

2014-05-14 13:29:18,403 [main] INFO  com.rsa.soc.re.contentstore.jcr.JCRContentStore - Checking for node type :  CHARTGROUP

2014-05-14 13:29:18,403 [main] INFO  com.rsa.soc.re.contentstore.jcr.JCRContentStore - Node type already exists :  CHARTGROUP

2014-05-14 13:29:18,406 [main] INFO  com.rsa.soc.re.contentstore.jcr.JCRContentStore - Init repository completed.

2014-05-14 13:29:18,406 [main] INFO  com.rsa.soc.re.contentstore.impl.ReportingContentStoreImpl - Permissions are already set for content store

2014-05-14 13:29:19,227 [main] INFO  com.rsa.soc.re.resultstore.ResultStoreCacheThreadPool - Maximum Thread pool size should greater than 1. Setting maximum thread pool size to 2

2014-05-14 13:29:19,557 [main] INFO  com.rsa.soc.re.status.manager.report.ReportStatusManagerImpl - Retrieve the deprecated running reports from database to mark with 'FAILED' state during Reporting Engine Reboot

2014-05-14 13:29:19,593 [main] INFO  com.rsa.soc.re.status.dao.report.impl.ReportStatusDAOImpl - Execute the named query to retrieve the reports with 'RUNNING' execution state from database

2014-05-14 13:29:19,609 [main] INFO  com.rsa.soc.re.status.manager.report.ReportStatusManagerImpl - Retrieve the reports from database which have FormatStatus QUEUED OR RUNNING

2014-05-14 13:29:19,610 [main] INFO  com.rsa.soc.re.status.dao.report.impl.ReportStatusDAOImpl - Execute the named query to retrieve the reports which have FormatStatus QUEUED OR RUNNING

2014-05-14 13:29:19,613 [main] INFO  com.rsa.soc.re.status.dao.report.impl.ReportStatusDAOImpl - Save the collection of entities in database:  0

2014-05-14 13:29:19,615 [RE-CommonThreadPool-0] INFO  com.rsa.soc.re.status.manager.report.ReportStatusManagerImpl - Initialize the LastExecutedReport Map during re-boot

2014-05-14 13:29:19,618 [RE-CommonThreadPool-0] INFO  com.rsa.soc.re.status.dao.report.impl.ReportStatusDAOImpl - Execute the named query to retrieve all the latest executed reports for all the run definitions from database

2014-05-14 13:29:19,639 [RE-CommonThreadPool-0] INFO  com.rsa.soc.re.status.manager.report.ReportStatusManagerImpl - Initialization of the LastExecutedReport Map completed

2014-05-14 13:29:22,132 [main] INFO  com.rsa.soc.datasource.nextgen.NextGenDataSourceConnectionFactory - No NextGen connections are initialized as there are no NextGen data source configurations found.

2014-05-14 13:29:22,189 [main] INFO  com.rsa.soc.datasource.ipdb.IPDBDataSourceConnectionFactory - No datasources of type IPDB connected.

2014-05-14 13:29:22,249 [main] INFO  com.rsa.soc.datasource.warehouse.WarehouseDataSourceConnectionFactory - No Warehouse connections are initialized as there are no Warehouse data source configurations found

2014-05-14 13:29:22,251 [main] INFO  com.rsa.soc.datasource.nextgen.CoreArchiverDataSourceConnectionFactory - No NextGen connections are initialized as there are no NextGen data source configurations found.

2014-05-14 13:29:22,270 [main] INFO  com.rsa.soc.re.status.manager.alert.AlertStatusManagerImpl - Retrieve the deprecated running alerts from database to mark with 'FAILED' state during Reporting Engine Re-Boot

2014-05-14 13:29:22,271 [main] INFO  com.rsa.soc.re.status.dao.alert.impl.AlertStatusDAOImpl - Execute the named query to retrieve the alerts with 'RUNNING' execution state from database

2014-05-14 13:29:22,312 [main] INFO  com.rsa.soc.re.scheduler.SchedulerHelper - Initializing the start of quartz scheduler

2014-05-14 13:29:22,351 [main] INFO  com.rsa.soc.re.scheduler.SchedulerHelper - Initialization of the quartz scheduler ended

2014-05-14 13:29:22,626 [main] INFO  com.rsa.soc.re.status.manager.report.ReportStatusManagerImpl - Add the observer to receive notification when execution status is completed

2014-05-14 13:29:22,649 [main] INFO  com.rsa.soc.re.status.manager.alert.AlertStatusManagerImpl - Add the observer to receive notification when execution status is completed

2014-05-14 13:29:22,743 [main] INFO  com.rsa.soc.re.outputaction.email.EmailOutputActionHandler - Cleaning up folders from previous runs

2014-05-14 13:29:22,749 [main] INFO  com.rsa.soc.re.outputaction.email.EmailOutputActionHandler - Creating new output directory

2014-05-14 13:29:22,952 [RE-ScheduledThreadPool] INFO  com.rsa.soc.re.queryprocessor.schema.SchemaRefreshJob - Datasource schema update starting

2014-05-14 13:29:22,954 [RE-ScheduledThreadPool] INFO  com.rsa.soc.re.queryprocessor.schema.SchemaRefreshJob - Datasource schema update jobs spawned

2014-05-14 13:29:23,120 [main] INFO  com.rsa.soc.re.utils.LoggingConfigManager - Explicitly setting root log level

2014-05-14 13:29:23,179 [main] INFO  com.rsa.soc.re.outputaction.syslog.SyslogProvider - Configuring UDP syslog provider

2014-05-14 13:29:23,211 [main] INFO  com.rsa.soc.datasource.sql.gp.GPDataSourceConnectionFactory - Received data source configuration change event.

2014-05-14 13:29:23,212 [main] INFO  com.rsa.soc.re.utils.LoggingConfigManager - config event recvd

2014-05-14 13:29:23,215 [main] INFO  com.rsa.netwitness.carlos.config.ConfigurationMXBean - REVersion changed by Unknown identity

2014-05-14 13:29:23,246 [main] INFO  com.rsa.soc.re.livechart.db.UpgradeLiveChartSchema - Livechart result tables schema is already updated.

2014-05-14 13:29:24,215 [main] INFO  com.rsa.netwitness.carlos.transport.impl.DefaultMessageEndpointFactory - The default local message endpoint is vives://127.0.0.1:51113?carlos.dispatch.pool=25&carlos.dispatch.queue=25

2014-05-14 13:29:24,266 [main] INFO  com.rsa.netwitness.carlos.transport.spring.MessageEndpointServiceExporter - Service on channel com.rsa.netwitness.carlos.logging.LoggingServiceProtocol$LoggingMessage bound to local endpoint vives://127.0.0.1:51113?carlos.dispatch.pool=25&carlos.dispatch.queue=25

2014-05-14 13:29:24,293 [main] INFO  com.rsa.netwitness.carlos.transport.spring.MessageEndpointServiceExporter - Service on channel com.rsa.netwitness.carlos.management.ManagementProtocol$ManagementMessage bound to local endpoint vives://127.0.0.1:51113?carlos.dispatch.pool=25&carlos.dispatch.queue=25

2014-05-14 13:29:25,093 [main] INFO  com.rsa.netwitness.carlos.transport.spring.MessageEndpointServiceExporter - Service on channel com.rsa.netwitness.carlos.reporting.ReportingServiceProtocol$ReportingMessage bound to local endpoint vives://127.0.0.1:51113?carlos.dispatch.pool=25&carlos.dispatch.queue=25

2014-05-14 13:29:25,114 [main] INFO  com.rsa.netwitness.carlos.transport.spring.MessageEndpointServiceExporter - Service on channel com.rsa.netwitness.carlos.security.SecurityManagerProtocol$SecurityManagerMessage bound to local endpoint vives://127.0.0.1:51113?carlos.dispatch.pool=25&carlos.dispatch.queue=25

2014-05-14 13:29:25,460 [main] INFO  com.rsa.netwitness.carlos.jmx.DefaultConnectorServerFactoryBean - JMX connector server started: javax.management.remote.rmi.RMIConnectorServer@73549a7c

2014-05-14 13:29:25,462 [main] INFO  com.rsa.netwitness.carlos.jmx.DefaultConnectorServerFactoryBean - JMX consoles can connect to service:jmx:rmi://RSA-AS-MD7:0/jndi/rmi://RSA-AS-MD7:50011/carlos

2014-05-14 13:29:25,731 [main] INFO  com.rsa.soc.re.status.manager.report.ReportStatusManagerImpl - Add the observer to receive notification when execution status is completed

2014-05-14 13:29:25,883 [main] INFO  com.rsa.soc.datasource.sql.gp.GPDataSourceConnectionFactory - Received data source configuration change event.

2014-05-14 13:29:25,883 [main] INFO  com.rsa.soc.re.utils.LoggingConfigManager - config event recvd

2014-05-14 13:29:25,884 [main] INFO  com.rsa.netwitness.carlos.config.ConfigurationMXBean - ConfigRE_10_3 changed by username

2014-05-14 13:29:25,884 [main] INFO  com.rsa.soc.re.scheduler.alert.AlertScheduler - Restoring the alert schedule jobs

2014-05-14 13:29:25,885 [main] INFO  com.rsa.soc.re.scheduler.alert.AlertScheduler - No of alert jobs restored :  0 (out of  0  alerts).

2014-05-14 13:29:25,886 [main] INFO  com.rsa.soc.re.livechart.run.LiveChartSchedulerImpl - Restored  0  chart jobs.

2014-05-14 13:29:25,888 [main] INFO  com.rsa.soc.re.server.startup.DeployWar - @@@ Application startup completed in  37  seconds

[huanzhou1]

did you reinstall the reporting engine? so far what i encouter is existing rules/reports will cause the problem.

try report the rpm, then rename the folder /home/rsasoc/rsa/soc/reporting-engine, then reinstall the rpm

[Anonymous]

Thanks! This solution help me solve my problem!