Error in RSA Security Analytics 10.5.0.1: "Failed to add destination" returned while configuring Push model in VLC

[#1]

Article Number

000001589

Applies To

RSA Product Set: Security Analytics
RSA Product/Service Type: SA Virtual Log Collector
RSA Version/Condition: 10.5.0.1
Platform: CentOS
O/S Version: 6
 

Issue

During Virtual Log Collector (VLC) push configuration, Log Collector (LC) needs to be added as a destination in VLC->Config->Local collector tab as below.

Cause

This 500 Response Error indicates VLC is not getting an appropriate response from Local collector within the expected time.

Resolution

Please follow below steps to stop the warning comes up during Push configuration and to add a Log Collector as destination successfully.

1. SSH into the VLC and LC with the root account.
2. Restart the rabbitmq-server service by running the following command.

service rabbitmq-server restart

3. Test if the LC can be added.
4. If the issue continues, run reboot command from the VLC to reboot the system or also restart the collector services on both log decoder and VLC.

restart nwlogcollector

5 Wait till the VLC comes up and try configuring VLC Push configuration by navigating to VLC->Config->Local collector tab in SA GUI.