Reporting Engine log ERROR

[Anonymous]

Following Error is at our Reporing Engine Log:

com.rsa.soc.re.outputaction.messagebus.MessageBusOutputActionHandler: Message Bus Output Action failed : com.rabbitmq.client.AlreadyClosedException: connection is already closed due to connection error; protocol method: #method<connection.close>(reply-code=320, reply-text=CONNECTION_FORCED - broker forced connection closure with reason 'shutdown', class-id=0, method-id=0)

Reporting Engine doesn't send alerts to incident management yet.

Does anybody know how to fix it?

[RSAAdmin]

Can you try checking whether the rabbitmq broker service is up and running?

Also check whether IM service is up and consuming the events.

[Anonymous]

RabbitMQ Broker is stomp?

[root@saserver ~]# service rabbitmq-server status

Status of node sa@localhost ...

[{pid,17102},

{running_applications,

     [{rabbitmq_federation_management,"RabbitMQ Federation Management",

          "3.3.4"},

      {rabbitmq_management,"RabbitMQ Management Console","3.3.4"},

      {rabbitmq_web_dispatch,"RabbitMQ Web Dispatcher","3.3.4"},

      {webmachine,"webmachine","1.10.3-rmq3.3.4-gite9359c7"},

      {mochiweb,"MochiMedia Web Server","2.7.0-rmq3.3.4-git680dba8"},

      {rabbitmq_federation,"RabbitMQ Federation","3.3.4"},

      {rabbitmq_stomp,"Embedded Rabbit Stomp Adapter","3.3.4"},

      {rabbit,"RabbitMQ","3.3.4"},

      {ssl,"Erlang/OTP SSL application","5.3.2"},

      {public_key,"Public key infrastructure","0.21"},

      {crypto,"CRYPTO version 2","3.2"},

      {asn1,"The Erlang ASN1 compiler version 2.0.4","2.0.4"},

      {os_mon,"CPO  CXC 138 46","2.2.14"},

      {inets,"INETS  CXC 138 49","5.9.7"},

      {mnesia,"MNESIA  CXC 138 12","4.11"},

      {amqp_client,"RabbitMQ AMQP Client","3.3.4"},

      {rabbitmq_auth_mechanism_ssl,

          "RabbitMQ SSL authentication (SASL EXTERNAL)","3.3.4"},

      {xmerl,"XML parser","1.3.5"},

      {sasl,"SASL  CXC 138 11","2.3.4"},

      {stdlib,"ERTS  CXC 138 10","1.19.4"},

      {kernel,"ERTS  CXC 138 10","2.16.4"}]},

{os,{unix,linux}},

{erlang_version,

     "Erlang R16B03 (erts-5.10.4) [source] [64-bit] [smp:4:4] [async-threads:30] [kernel-poll:true]\n"},

{memory,

     [{total,108017392},

      {connection_procs,7017832},

      {queue_procs,7623072},

      {plugins,1135328},

      {other_proc,19369840},

      {mnesia,986096},

      {mgmt_db,5238248},

      {msg_index,330528},

      {other_ets,1682848},

      {binary,36013760},

      {code,22326442},

      {atom,801697},

      {other_system,5491701}]},

{alarms,[]},

{listeners,

     [{clustering,25672,"::"},

      {amqp,5672,"127.0.0.1"},

      {'amqp/ssl',5671,"::"},

      {'stomp/ssl',61614,"::"}]},

{vm_memory_high_watermark,0.4},

{vm_memory_limit,3301915033},

{disk_free_limit,2146641920},

{disk_free,6612631552},

{file_descriptors,

     [{total_limit,3996},

      {total_used,67},

      {sockets_limit,3594},

      {sockets_used,64}]},

{processes,[{limit,1048576},{used,1789}]},

{run_queue,1},

{uptime,1705}]

...done.

How to check rsa-im is consuming events?

[root@saserver ~]# service rsa-im status

RSA Security Analytics Incident Management :: Server is running (1898).

[RSAAdmin]

Which SA and RE builds are you using?

Did the IM service got restarted? Can you check "/opt/rsa/im/logs/im.log" for the details.

If the IM service was restarted, can you try restarting the RE service and check?

This error could have been thrown, if the IM service or rabbitmq broker service was restarted. So, please restart RE and try.

[Anonymous]

connect to the database in the config section

the user/pwd is: im/im

and the ip according to your settings.