"ERR_CONNECTION_REFUSED" is displayed when accessing the RSA Security Analytics UI

[#1]

Article Number

000031574

Applies To

RSA Product Set: Security Analytics
RSA Product/Service Type: Security Analytics Server, Security Analytics UI
RSA Version/Condition: 10.4.x, 10.5.x
Platform: Software / Puppetmaster
O/S Version: CentOS 6
 

Issue

When accessing the Security Analytics web UI, the browser returns "This web page is not available ERR_CONNECTION_REFUSED" as shown below.
Image description

This issue is noticed after restarting the jettysrv service or rebooting the Security Ananlytics server host.

The /var/lib/netwitness/uax/logs/sa.log file may show APPARENT DEADLOCK!!! as shown below.

2015-10-23 00:49:17,910 [Timer-1] WARN  com.mchange.v2.async.ThreadPoolAsynchronousRunner - com.mchange.v2.async.ThreadPoolAsynchronousRunner$DeadlockDetector@6c362815 -- APPARENT DEADLOCK!!! Creating emergency threads for unassigned pending tasks!

Running puppet agent -t returns Error: Could not send report: Connection refused - connect(2) as shown in the screenshot below.
Image description
 

Cause

This issue can occur when puppetmaster service is stopped or disabled.
Run the following commands to confirm the status of puppetmaster service.
1. service puppetmaster status
2. chkconfig puppetmaster --list

The following results from the above command indicate the puppetmaster service is either stopped or disabled.
1. puppet dead but subsys locked
2. puppetmaster    0:off   1:off   2:off    3:off    4:off    5:off    6:off


 

Resolution

To resolve the issue, start and enable puppetmaster service, restart jettysrv and run puppet agent -t with the commands below.
1. service puppetmaster start
2. chkconfig puppetmaster on
3. restart jettysrv
4. puppet agent -t