Renaming the Log Collector or Log Decoder hostname is not reflected on the Event Sources Manage page in RSA Security Analytics

[#1]

Article Number

000030589

Applies To

RSA Product Set: Security Analytics
RSA Product/Service Type: Log Decoder, Log Collector, Security Analytics UI, Security Analytics Server
RSA Version/Condition: 10.5.x, 10.6.0.0
Platform: CentOS
O/S Version: EL6

Issue

On the Administration -> Hosts page in the Security Analytics UI, if you edit the Log Collector or Log Decoder appliance name, then the change will not be reflected on the Administration -> Event Sources -> Manage page in the Log Collector or Log Decoder columns.

Image description

Resolution

This issue is currently being investigated by the Engineering team in order for it to be resolved in a future release.

Workaround

Once you update a host name from the Administration -> Hosts page, the following steps must be performed:

1. Connect to the Security Analytics Server appliance via SSH as the root user.
2. Restart the SMS service by issuing the following command:  service rsa-sms restart
3. In the Security Analytics UI, wait for the Administration -> Event Sources -> Manage page to come back up.
4. On that page, delete the event sources with the old Log Collector or Log Decoder names.

If you are collecting events from deleted event sources, then they will be automatically added back to the Administration -> Event Sources -> Manage page with the new Log Collector or Log Decoder name.

If you are unsure of any of the steps above or experience any issues, contact RSA Support and quote this article number for further assistance.