Failed to modify or delete Remote Destination from VLC in RSA Security Analytics

[#1]

Article Number

000032794

Applies To

RSA Product Set: Security Analytics
RSA Product/Service Type: Log Collector, Virtual Log Collector
RSA Version/Condition: 10.4.x, 10.5.x
Platform: CentOS
O/S Version: 6
 

Issue

An attempt to modify or delete remote destination from VLC returns the following warming message.
 

Warning
Failed to update remote destination: Invalid or missing address: '<IP Address of LC>' 
Try adding the device to SA if not already added.

Image description

 

Cause

It could be an issue if  VLC/LC was added to SA Server manually using username/password and is not communicating with SA through trusted connection.

Resolution

1) Check LC/VLC connected to SA through trusted connection.
If using the trusted connection, Test Connection in the Add Service dialog will complete successfully with the Username and Password left blank.

2) Remove the Destination Collectors in Explore view

a. Get Destination Group name 

From the Explore view, right click on Administration->services->VLC->Explore->event-broker->config->destinations, select Properties, select List from the dropdown menu and press the Send button.

             Image description
 

b. Find the Destination Group name and remove using the option remove

              Select remove from the dropdown menu, add name=<Destination Group name noted in a> (e.g. name=LOGDEC) to the Parameters field and press the Send button.
              Image description   
     
 3) Add the Destination Group again
From the Log Collector's Config->Event Destinations, press the + icon under the Destination Groups pane.
       Image description  

       Image description