Article Number
000030579
Applies To
RSA Product Set: Security Analytics
RSA Product/Service Type: Security Analytics UI, Security Analytics Server, Health and Wellness
RSA Version/Condition: 10.5.0.x, 10.5.1
Platform: CentOS
O/S Version: EL6
Issue
On the first restart of the Security Analytics UI server following an upgrade, post upgrade processing begins to migrate the hosts, services, and group information into the Host and Service groupings. Before the migration completes, the System Monitoring Service (SMS) may incorrectly exclude hosts from being associated with the Health & Wellness policy rules.
If the host is excluded, it will not be associated with its Health & Wellness policy rules.If the host is not associated with its Health & Wellness policy rules then any alarms for that host, based on the policy rules, will not be activated.
Resolution
This issue is being investigated by the Engineering team in order to be resolved in a future release.
Workaround
On 10.5.0.1, 10.5.0.2 and 10.5.1, typically restarting the rsa-sms service will trigger the alerts to fire again.
service rsa-sms restart
This can be done in production without affecting core functionality.
In addition on 10.5.0.0, after the upgrade has completed, follow these steps and note that an occasional restart of the service is required to re-trigger alerts as listed above.
- Log into the Security Analytics UI (if the login is successful the migration is complete).
- Using a secure shell program, SSH into the Security Analytics UI server as the root user.
- Reboot the Security Analytics UI server.
reboot
