RSA Security Analytics Virtual Remote Log Collector does not switch back to Primary Local Log Collector when Primary becomes available again after a failover

[#1]

Article Number

000002010

Applies To

RSA Product Set: Security Analytics, NetWitness Logs & Packets
RSA Product/Service Type: Virtual Log Collector (VLC)

Issue

RSA Security Analytics Virtual Remote Log Collector does not switch back to Primary Local Log Collector when Primary becomes available again after a failover.
A Virtual Log Collector is configured which communicates with two local collectors.
The user wishes that when the highest priority local collector becomes available again, the logs are sent to this collector.

Resolution

In order to resolve the issue, follow the steps below:

1. Log onto the Remote log Collector via REST using the following URL:  http://<remote_log_collector_ip>:50101/sys/config
   NOTE:  Be sure to change the URL to use https:// if SSL has been configured for the device.
2. Enter the service credentials for the device.  (Default:  admin/netwitness)
3. Scroll down to the scheduler(*) entry.
4. Click on the * next to the scheduler.
5. Scroll to the bottom of the page and locate the following:  Properties for sys/config/scheduler
6. From the drop down menu, select addInter.
7. In the parameters box enter the following:  message=restart minutes=5 pathname=/event-broker/
8. Click on the Send button. The Output box should display success.
9. From the drop down menu, select ls. You should see the following message:  4730 = minutes=1 message=restart pathname=/event-broker/
   NOTE:  The first 4 digits may be different in your environment.

By making the changes above, the event broker service will restart every 5 minutes. The primary, prefered Local Log Collector will then become active again.

Notes

For additional information and screenshots, refer to the attached documentation.