ESA rule deployment fails if the server that hosts an external database goes down in RSA Security Analytics

[#1]

Article Number

000030554

Applies To

RSA Product Set: Security Analytics
RSA Product/Service Type: Event Stream Analysis (ESA), Security Analytics UI
RSA Version/Condition: 10.5.x, 10.6.0.0
Platform: CentOS
O/S Version: EL6

Issue

New Deployments for Rules fails with below errors when ESA has database connections configured as enrichment source.

Image description

Errors similar to those listed below are found in the /opt/rsa/esa/logs/esa.log file.

2015-04-27 22:30:21,699 [Carlos@389e47b7-17(run(GetAvailableJdbcDrivers))(admin)] INFO com.rsa.netwitness.carlos.transport.RequestChannelListener - API Invocation Audit: identity=admin, action=GetAvailableJdbcDrivers, object=<all>, success=true

2015-04-27 22:30:24,729 [Carlos@1928841a-18(run(SetDatabaseReference))(admin)] WARN com.rsa.netwitness.core.enrichment.DatabaseReferenceManager - Connection validation for database reference "test" - success: false, details: Cannot create PoolableConnectionFactory (The connection attempt failed.) 

Cause

When a database connection is configured to use the database as an enrichment source for a rule, a reference to the data base is deployed on every ESA even if the ESA does not deploy any rules that use the database.
If the server that hosts the database goes down, any new deployment will fail.

Workaround

Restart the server that hosts the database.

If you are unsure of any of the steps above or experience any issues, contact RSA Support and quote this article number for further assistance.