ESM manager service is initializing after upgrade.

Hello,

after upgrade from 7.3 to 7.5 version of ESM I have this status:

aps service is available
execprocsvc service is unavailable
logger_httpd service is available
logger_servers service is available
logger_web service is available
manager service is initializing
mysqld service is available
postgresql service is available

I have already tried restart system and services. Also, I dont see any logs at /opt/arcsight/manager/logs

What problem could it be ?


Thank you
John

  • Ok so logs will be in "/opt/arcsight/var/logs" not "/opt/arcsight/manager/logs" check there and let us know what the logs say. Were all the pre-reqs completed prior to upgrading?

  • Yes all prereq were complete. This is what I found in the logs.

    org.jdom.JDOMException: Error in SAX parser allocation: SAX2 driver class org.apache.xerces.parsers.SAXParser not found: Illegal access: this web application instance has been stopped already. Could not load [org.apache.xerces.parsers.SAXParser]. The following stack trace is thrown for debugging purposes as well as to attempt to terminate the thread which caused the illegal access.
    	at org.jdom.output.SAXOutputter.createDTDParser(SAXOutputter.java:1356)
    	at org.jdom.output.SAXOutputter.dtdEvents(SAXOutputter.java:771)
    	at org.jdom.output.SAXOutputter.output(SAXOutputter.java:607)
    	at org.jdom.transform.JDOMSource$DocumentReader.parse(JDOMSource.java:476)
    	at com.icl.saxon.Builder.build(Builder.java:263)
    	at com.arcsight.tools.query.f.a(f.java:117)
    	at com.arcsight.tools.query.QueryParser.translate(QueryParser.java:140)
    	at com.arcsight.tools.query.QueryParser.translate(QueryParser.java:115)
    	at com.arcsight.common.dynachannel.QueryIntrospectableBucketizer.getBucketIdQuery(QueryIntrospectableBucketizer.java:565)
    	at com.arcsight.common.dynachannel.QueryDynaChannelImpl.getSequenceForBucketHelper(QueryDynaChannelImpl.java:423)
    	at com.arcsight.common.dynachannel.QueryDynaChannelImpl.doGetSequenceForBucket(QueryDynaChannelImpl.java:313)
    	at com.arcsight.common.dynachannel.QueryDynaChannelImpl.getSequenceForBucket(QueryDynaChannelImpl.java:286)
    	at com.arcsight.common.persist.oracle.OracleDynaChannelBroker.getSequenceForBucket(OracleDynaChannelBroker.java:198)
    	at com.arcsight.product.esmclient.business.channel.ChannelDataUtil.populateChannelResult(ChannelDataUtil.java:386)
    	at com.arcsight.product.esmclient.business.channel.ChannelDataUtil.createChannelResult(ChannelDataUtil.java:239)
    	at com.arcsight.product.esmclient.service.v1.impl.ChannelServiceImpl.getChannelInfo(ChannelServiceImpl.java:198)
    	at com.arcsight.product.esmclient.service.v1.impl.AccessControlledChannelServiceImpl.getChannelInfo(AccessControlledChannelServiceImpl.java:837)
    	at com.arcsight.product.esmclient.service.v1.gwt.server.ChannelServiceImpl.getChannelInfo(ChannelServiceImpl.java:763)
    	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    	at java.lang.reflect.Method.invoke(Method.java:498)
    	at com.google.gwt.user.server.rpc.RPC.invokeAndEncodeResponse(RPC.java:587)
    	at com.google.gwt.user.server.rpc.RemoteServiceServlet.processCall(RemoteServiceServlet.java:333)
    	at com.google.gwt.user.server.rpc.RemoteServiceServlet.processCall(RemoteServiceServlet.java:303)
    	at com.google.gwt.user.server.rpc.RemoteServiceServlet.processPost(RemoteServiceServlet.java:373)
    	at com.google.gwt.user.server.rpc.AbstractRemoteServiceServlet.doPost(AbstractRemoteServiceServlet.java:62)
    	at javax.servlet.http.HttpServlet.service(HttpServlet.java:660)
    	at javax.servlet.http.HttpServlet.service(HttpServlet.java:741)
    	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:231)
    	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
    	at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53)
    	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
    	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
    	at com.arcsight.coma.servlet.ServerContextFilter.doFilter(ServerContextFilter.java:56)
    	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
    	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
    	at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:202)
    	at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96)
    	at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:541)
    	at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:139)
    	at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)
    	at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74)
    	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343)
    	at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:373)
    	at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)
    	at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:868)
    	at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1590)
    	at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
    	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
    	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
    	at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
    	at java.lang.Thread.run(Thread.java:748)
    Caused by: org.xml.sax.SAXException: SAX2 driver class org.apache.xerces.parsers.SAXParser not found
    java.lang.ClassNotFoundException: Illegal access: this web application instance has been stopped already. Could not load [org.apache.xerces.parsers.SAXParser]. The following stack trace is thrown for debugging purposes as well as to attempt to terminate the thread which caused the illegal access.
    	at org.xml.sax.helpers.XMLReaderFactory.loadClass(XMLReaderFactory.java:230)
    	at org.xml.sax.helpers.XMLReaderFactory.createXMLReader(XMLReaderFactory.java:221)
    	at org.jdom.output.SAXOutputter.createParser(SAXOutputter.java:1330)
    	at org.jdom.output.SAXOutputter.createDTDParser(SAXOutputter.java:1353)
    	... 52 more
    Caused by: java.lang.ClassNotFoundException: Illegal access: this web application instance has been stopped already. Could not load [org.apache.xerces.parsers.SAXParser]. The following stack trace is thrown for debugging purposes as well as to attempt to terminate the thread which caused the illegal access.
    	at org.apache.catalina.loader.WebappClassLoaderBase.checkStateForClassLoading(WebappClassLoaderBase.java:1375)
    	at org.apache.catalina.loader.WebappClassLoaderBase.loadClass(WebappClassLoaderBase.java:1226)
    	at org.apache.catalina.loader.WebappClassLoaderBase.loadClass(WebappClassLoaderBase.java:1188)
    	at org.xml.sax.helpers.NewInstance.newInstance(NewInstance.java:82)
    	at org.xml.sax.helpers.XMLReaderFactory.loadClass(XMLReaderFactory.java:228)
    	... 55 more
    Caused by: java.lang.IllegalStateException: Illegal access: this web application instance has been stopped already. Could not load [org.apache.xerces.parsers.SAXParser]. The following stack trace is thrown for debugging purposes as well as to attempt to terminate the thread which caused the illegal access.
    	at org.apache.catalina.loader.WebappClassLoaderBase.checkStateForResourceLoading(WebappClassLoaderBase.java:1385)
    	at org.apache.catalina.loader.WebappClassLoaderBase.checkStateForClassLoading(WebappClassLoaderBase.java:1373)
    	... 59 more
    org.xml.sax.SAXException: SAX2 driver class org.apache.xerces.parsers.SAXParser not found
    java.lang.ClassNotFoundException: Illegal access: this web application instance has been stopped already. Could not load [org.apache.xerces.parsers.SAXParser]. The following stack trace is thrown for debugging purposes as well as to attempt to terminate the thread which caused the illegal access.
    	at org.xml.sax.helpers.XMLReaderFactory.loadClass(XMLReaderFactory.java:230)
    	at org.xml.sax.helpers.XMLReaderFactory.createXMLReader(XMLReaderFactory.java:221)
    	at org.jdom.output.SAXOutputter.createParser(SAXOutputter.java:1330)
    	at org.jdom.output.SAXOutputter.createDTDParser(SAXOutputter.java:1353)
    	at org.jdom.output.SAXOutputter.dtdEvents(SAXOutputter.java:771)
    	at org.jdom.output.SAXOutputter.output(SAXOutputter.java:607)
    	at org.jdom.transform.JDOMSource$DocumentReader.parse(JDOMSource.java:476)
    	at com.icl.saxon.Builder.build(Builder.java:263)
    	at com.arcsight.tools.query.f.a(f.java:117)
    	at com.arcsight.tools.query.QueryParser.translate(QueryParser.java:140)
    	at com.arcsight.tools.query.QueryParser.translate(QueryParser.java:115)
    	at com.arcsight.common.dynachannel.QueryIntrospectableBucketizer.getBucketIdQuery(QueryIntrospectableBucketizer.java:565)
    	at com.arcsight.common.dynachannel.QueryDynaChannelImpl.getSequenceForBucketHelper(QueryDynaChannelImpl.java:423)
    	at com.arcsight.common.dynachannel.QueryDynaChannelImpl.doGetSequenceForBucket(QueryDynaChannelImpl.java:313)
    	at com.arcsight.common.dynachannel.QueryDynaChannelImpl.getSequenceForBucket(QueryDynaChannelImpl.java:286)
    	at com.arcsight.common.persist.oracle.OracleDynaChannelBroker.getSequenceForBucket(OracleDynaChannelBroker.java:198)
    	at com.arcsight.product.esmclient.business.channel.ChannelDataUtil.populateChannelResult(ChannelDataUtil.java:386)
    	at com.arcsight.product.esmclient.business.channel.ChannelDataUtil.createChannelResult(ChannelDataUtil.java:239)
    	at com.arcsight.product.esmclient.service.v1.impl.ChannelServiceImpl.getChannelInfo(ChannelServiceImpl.java:198)
    	at com.arcsight.product.esmclient.service.v1.impl.AccessControlledChannelServiceImpl.getChannelInfo(AccessControlledChannelServiceImpl.java:837)
    	at com.arcsight.product.esmclient.service.v1.gwt.server.ChannelServiceImpl.getChannelInfo(ChannelServiceImpl.java:763)
    	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    	at java.lang.reflect.Method.invoke(Method.java:498)
    	at com.google.gwt.user.server.rpc.RPC.invokeAndEncodeResponse(RPC.java:587)
    	at com.google.gwt.user.server.rpc.RemoteServiceServlet.processCall(RemoteServiceServlet.java:333)
    	at com.google.gwt.user.server.rpc.RemoteServiceServlet.processCall(RemoteServiceServlet.java:303)
    	at com.google.gwt.user.server.rpc.RemoteServiceServlet.processPost(RemoteServiceServlet.java:373)
    	at com.google.gwt.user.server.rpc.AbstractRemoteServiceServlet.doPost(AbstractRemoteServiceServlet.java:62)
    	at javax.servlet.http.HttpServlet.service(HttpServlet.java:660)
    	at javax.servlet.http.HttpServlet.service(HttpServlet.java:741)
    	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:231)
    	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
    	at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53)
    	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
    	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
    	at com.arcsight.coma.servlet.ServerContextFilter.doFilter(ServerContextFilter.java:56)
    	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
    	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
    	at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:202)
    	at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96)
    	at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:541)
    	at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:139)
    	at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)
    	at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74)
    	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343)
    	at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:373)
    	at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)
    	at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:868)
    	at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1590)
    	at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
    	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
    	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
    	at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
    	at java.lang.Thread.run(Thread.java:748)
    Caused by: java.lang.ClassNotFoundException: Illegal access: this web application instance has been stopped already. Could not load [org.apache.xerces.parsers.SAXParser]. The following stack trace is thrown for debugging purposes as well as to attempt to terminate the thread which caused the illegal access.
    	at org.apache.catalina.loader.WebappClassLoaderBase.checkStateForClassLoading(WebappClassLoaderBase.java:1375)
    	at org.apache.catalina.loader.WebappClassLoaderBase.loadClass(WebappClassLoaderBase.java:1226)
    	at org.apache.catalina.loader.WebappClassLoaderBase.loadClass(WebappClassLoaderBase.java:1188)
    	at org.xml.sax.helpers.NewInstance.newInstance(NewInstance.java:82)
    	at org.xml.sax.helpers.XMLReaderFactory.loadClass(XMLReaderFactory.java:228)
    	... 55 more
    Caused by: java.lang.IllegalStateException: Illegal access: this web application instance has been stopped already. Could not load [org.apache.xerces.parsers.SAXParser]. The following stack trace is thrown for debugging purposes as well as to attempt to terminate the thread which caused the illegal access.
    	at org.apache.catalina.loader.WebappClassLoaderBase.checkStateForResourceLoading(WebappClassLoaderBase.java:1385)
    	at org.apache.catalina.loader.WebappClassLoaderBase.checkStateForClassLoading(WebappClassLoaderBase.java:1373)
    	... 59 more
    java.lang.ClassNotFoundException: Illegal access: this web application instance has been stopped already. Could not load [org.apache.xerces.parsers.SAXParser]. The following stack trace is thrown for debugging purposes as well as to attempt to terminate the thread which caused the illegal access.
    	at org.apache.catalina.loader.WebappClassLoaderBase.checkStateForClassLoading(WebappClassLoaderBase.java:1375)
    	at org.apache.catalina.loader.WebappClassLoaderBase.loadClass(WebappClassLoaderBase.java:1226)
    	at org.apache.catalina.loader.WebappClassLoaderBase.loadClass(WebappClassLoaderBase.java:1188)
    	at org.xml.sax.helpers.NewInstance.newInstance(NewInstance.java:82)
    	at org.xml.sax.helpers.XMLReaderFactory.loadClass(XMLReaderFactory.java:228)
    	at org.xml.sax.helpers.XMLReaderFactory.createXMLReader(XMLReaderFactory.java:221)
    	at org.jdom.output.SAXOutputter.createParser(SAXOutputter.java:1330)
    	at org.jdom.output.SAXOutputter.createDTDParser(SAXOutputter.java:1353)
    	at org.jdom.output.SAXOutputter.dtdEvents(SAXOutputter.java:771)
    	at org.jdom.output.SAXOutputter.output(SAXOutputter.java:607)
    	at org.jdom.transform.JDOMSource$DocumentReader.parse(JDOMSource.java:476)
    	at com.icl.saxon.Builder.build(Builder.java:263)
    	at com.arcsight.tools.query.f.a(f.java:117)
    	at com.arcsight.tools.query.QueryParser.translate(QueryParser.java:140)
    	at com.arcsight.tools.query.QueryParser.translate(QueryParser.java:115)
    	at com.arcsight.common.dynachannel.QueryIntrospectableBucketizer.getBucketIdQuery(QueryIntrospectableBucketizer.java:565)
    	at com.arcsight.common.dynachannel.QueryDynaChannelImpl.getSequenceForBucketHelper(QueryDynaChannelImpl.java:423)
    	at com.arcsight.common.dynachannel.QueryDynaChannelImpl.doGetSequenceForBucket(QueryDynaChannelImpl.java:313)
    	at com.arcsight.common.dynachannel.QueryDynaChannelImpl.getSequenceForBucket(QueryDynaChannelImpl.java:286)
    	at com.arcsight.common.persist.oracle.OracleDynaChannelBroker.getSequenceForBucket(OracleDynaChannelBroker.java:198)
    	at com.arcsight.product.esmclient.business.channel.ChannelDataUtil.populateChannelResult(ChannelDataUtil.java:386)
    	at com.arcsight.product.esmclient.business.channel.ChannelDataUtil.createChannelResult(ChannelDataUtil.java:239)
    	at com.arcsight.product.esmclient.service.v1.impl.ChannelServiceImpl.getChannelInfo(ChannelServiceImpl.java:198)
    	at com.arcsight.product.esmclient.service.v1.impl.AccessControlledChannelServiceImpl.getChannelInfo(AccessControlledChannelServiceImpl.java:837)
    	at com.arcsight.product.esmclient.service.v1.gwt.server.ChannelServiceImpl.getChannelInfo(ChannelServiceImpl.java:763)
    	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    	at java.lang.reflect.Method.invoke(Method.java:498)
    	at com.google.gwt.user.server.rpc.RPC.invokeAndEncodeResponse(RPC.java:587)
    	at com.google.gwt.user.server.rpc.RemoteServiceServlet.processCall(RemoteServiceServlet.java:333)
    	at com.google.gwt.user.server.rpc.RemoteServiceServlet.processCall(RemoteServiceServlet.java:303)
    	at com.google.gwt.user.server.rpc.RemoteServiceServlet.processPost(RemoteServiceServlet.java:373)
    	at com.google.gwt.user.server.rpc.AbstractRemoteServiceServlet.doPost(AbstractRemoteServiceServlet.java:62)
    	at javax.servlet.http.HttpServlet.service(HttpServlet.java:660)
    	at javax.servlet.http.HttpServlet.service(HttpServlet.java:741)
    	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:231)
    	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
    	at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53)
    	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
    	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
    	at com.arcsight.coma.servlet.ServerContextFilter.doFilter(ServerContextFilter.java:56)
    	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
    	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
    	at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:202)
    	at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96)
    	at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:541)
    	at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:139)
    	at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)
    	at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74)
    	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343)
    	at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:373)
    	at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)
    	at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:868)
    	at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1590)
    	at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
    	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
    	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
    	at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
    	at java.lang.Thread.run(Thread.java:748)
    Caused by: java.lang.IllegalStateException: Illegal access: this web application instance has been stopped already. Could not load [org.apache.xerces.parsers.SAXParser]. The following stack trace is thrown for debugging purposes as well as to attempt to terminate the thread which caused the illegal access.
    	at org.apache.catalina.loader.WebappClassLoaderBase.checkStateForResourceLoading(WebappClassLoaderBase.java:1385)
    	at org.apache.catalina.loader.WebappClassLoaderBase.checkStateForClassLoading(WebappClassLoaderBase.java:1373)
    	... 59 more
    [2021-10-07 09:41:29,321][ERROR][default.com.arcsight.tools.query.QueryParser] <Query TimeZone="Europe/Prague">
      <FromClause>
        <Table Alias="event1" Name="Event" />
      </FromClause>
      <SelectClause>
        <SelectColumn>
          <Variable TableAlias="event1" Column="eventId" />
        </SelectColumn>
      </SelectClause>
      <WhereClause>
        <Condition ConditionType="Positive" TableAlias="event1">
          <And TableAlias="event1">
            <And TableAlias="event1">
              <ConstantCondition True="Yes" />
              <BasicCondition Operator="StartsWith" Negated="No" IgnoreCase="No" JoinCondition="No" ListCompare="ANY">
                <Variable Column="name" />
                <Value>[Alert]</Value>
              </BasicCondition>
              <BasicCondition Operator="NE" Negated="No" IgnoreCase="No" JoinCondition="No" ListCompare="ANY">
                <Variable Column="deviceHostName" />
                <Value>VltavaACb-New.csoblacc.int</Value>
              </BasicCondition>
              <BasicCondition Operator="NE" Negated="No" IgnoreCase="No" JoinCondition="No" ListCompare="ANY">
                <Variable Column="deviceHostName" />
                <Value>VltavaACa-New.csoblacc.int</Value>
              </BasicCondition>
              <Or TableAlias="event1">
                <BasicCondition Operator="Is" Negated="No" IgnoreCase="No" JoinCondition="No" ListCompare="ANY">
                  <Variable Column="sessionId" />
                  <Value>NULL</Value>
                </BasicCondition>
                <BasicCondition Operator="EQ" Negated="No" IgnoreCase="No" JoinCondition="No" ListCompare="ANY">
                  <Variable Column="sessionId" />
                  <Value>0</Value>
                </BasicCondition>
              </Or>
            </And>
            <And TableAlias="event1">
              <BasicCondition Operator="GE">
                <Variable TableAlias="event1" Column="endTime" />
                <Value>10/04/2021 00:14:00.000 +0200</Value>
              </BasicCondition>
              <BasicCondition Operator="LT">
                <Variable TableAlias="event1" Column="endTime" />
                <Value>10/04/2021 00:15:00.000 +0200</Value>
              </BasicCondition>
            </And>
          </And>
        </Condition>
      </WhereClause>
      <OrderByClause>
        <OrderByColumn Direction="DESC">
          <Variable Column="endTime" TableAlias="event1" />
        </OrderByColumn>
        <OrderByColumn Direction="ASC">
          <Variable Column="eventId" TableAlias="event1" />
        </OrderByColumn>
      </OrderByClause>
    </Query>
    [2021-10-07 09:41:29,321][ERROR][default.com.arcsight.common.dynachannel.QueryIntrospectableBucketizer] 
    com.arcsight.tools.query.ArlTransformationException: org.xml.sax.SAXException: Error in SAX parser allocation: SAX2 driver class org.apache.xerces.parsers.SAXParser not found: Illegal access: this web application instance has been stopped already. Could not load [org.apache.xerces.parsers.SAXParser]. The following stack trace is thrown for debugging purposes as well as to attempt to terminate the thread which caused the illegal access.
    org.jdom.JDOMException: Error in SAX parser allocation: SAX2 driver class org.apache.xerces.parsers.SAXParser not found: Illegal access: this web application instance has been stopped already. Could not load [org.apache.xerces.parsers.SAXParser]. The following stack trace is thrown for debugging purposes as well as to attempt to terminate the thread which caused the illegal access.
    	at com.arcsight.tools.query.QueryParser.translate(QueryParser.java:146)
    	at com.arcsight.tools.query.QueryParser.translate(QueryParser.java:115)
    	at com.arcsight.common.dynachannel.QueryIntrospectableBucketizer.getBucketIdQuery(QueryIntrospectableBucketizer.java:565)
    	at com.arcsight.common.dynachannel.QueryDynaChannelImpl.getSequenceForBucketHelper(QueryDynaChannelImpl.java:423)
    	at com.arcsight.common.dynachannel.QueryDynaChannelImpl.doGetSequenceForBucket(QueryDynaChannelImpl.java:313)
    	at com.arcsight.common.dynachannel.QueryDynaChannelImpl.getSequenceForBucket(QueryDynaChannelImpl.java:286)
    	at com.arcsight.common.persist.oracle.OracleDynaChannelBroker.getSequenceForBucket(OracleDynaChannelBroker.java:198)
    	at com.arcsight.product.esmclient.business.channel.ChannelDataUtil.populateChannelResult(ChannelDataUtil.java:386)
    	at com.arcsight.product.esmclient.business.channel.ChannelDataUtil.createChannelResult(ChannelDataUtil.java:239)
    	at com.arcsight.product.esmclient.service.v1.impl.ChannelServiceImpl.getChannelInfo(ChannelServiceImpl.java:198)
    	at com.arcsight.product.esmclient.service.v1.impl.AccessControlledChannelServiceImpl.getChannelInfo(AccessControlledChannelServiceImpl.java:837)
    	at com.arcsight.product.esmclient.service.v1.gwt.server.ChannelServiceImpl.getChannelInfo(ChannelServiceImpl.java:763)
    	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    	at java.lang.reflect.Method.invoke(Method.java:498)
    	at com.google.gwt.user.server.rpc.RPC.invokeAndEncodeResponse(RPC.java:587)
    	at com.google.gwt.user.server.rpc.RemoteServiceServlet.processCall(RemoteServiceServlet.java:333)
    	at com.google.gwt.user.server.rpc.RemoteServiceServlet.processCall(RemoteServiceServlet.java:303)
    	at com.google.gwt.user.server.rpc.RemoteServiceServlet.processPost(RemoteServiceServlet.java:373)
    	at com.google.gwt.user.server.rpc.AbstractRemoteServiceServlet.doPost(AbstractRemoteServiceServlet.java:62)
    	at javax.servlet.http.HttpServlet.service(HttpServlet.java:660)
    	at javax.servlet.http.HttpServlet.service(HttpServlet.java:741)
    	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:231)
    	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
    	at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53)
    	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
    	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
    	at com.arcsight.coma.servlet.ServerContextFilter.doFilter(ServerContextFilter.java:56)
    	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
    	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
    	at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:202)
    	at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96)
    	at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:541)
    	at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:139)
    	at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)
    	at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74)
    	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343)
    	at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:373)
    	at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)
    	at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:868)
    	at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1590)
    	at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
    	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
    	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
    	at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
    	at java.lang.Thread.run(Thread.java:748)
    Caused by: javax.xml.transform.TransformerException: org.xml.sax.SAXException: Error in SAX parser allocation: SAX2 driver class org.apache.xerces.parsers.SAXParser not found: Illegal access: this web application instance has been stopped already. Could not load [org.apache.xerces.parsers.SAXParser]. The following stack trace is thrown for debugging purposes as well as to attempt to terminate the thread which caused the illegal access.
    org.jdom.JDOMException: Error in SAX parser allocation: SAX2 driver class org.apache.xerces.parsers.SAXParser not found: Illegal access: this web application instance has been stopped already. Could not load [org.apache.xerces.parsers.SAXParser]. The following stack trace is thrown for debugging purposes as well as to attempt to terminate the thread which caused the illegal access.
    	at com.icl.saxon.Builder.build(Builder.java:271)
    	at com.arcsight.tools.query.f.a(f.java:117)
    	at com.arcsight.tools.query.QueryParser.translate(QueryParser.java:140)
    	... 46 more
    Caused by: org.xml.sax.SAXException: Error in SAX parser allocation: SAX2 driver class org.apache.xerces.parsers.SAXParser not found: Illegal access: this web application instance has been stopped already. Could not load [org.apache.xerces.parsers.SAXParser]. The following stack trace is thrown for debugging purposes as well as to attempt to terminate the thread which caused the illegal access.
    org.jdom.JDOMException: Error in SAX parser allocation: SAX2 driver class org.apache.xerces.parsers.SAXParser not found: Illegal access: this web application instance has been stopped already. Could not load [org.apache.xerces.parsers.SAXParser]. The following stack trace is thrown for debugging purposes as well as to attempt to terminate the thread which caused the illegal access.
    	at org.jdom.transform.JDOMSource$DocumentReader.parse(JDOMSource.java:483)
    	at com.icl.saxon.Builder.build(Builder.java:263)
    	... 48 more
    Caused by: org.jdom.JDOMException: Error in SAX parser allocation: SAX2 driver class org.apache.xerces.parsers.SAXParser not found: Illegal access: this web application instance has been stopped already. Could not load [org.apache.xerces.parsers.SAXParser]. The following stack trace is thrown for debugging purposes as well as to attempt to terminate the thread which caused the illegal access.
    	at org.jdom.output.SAXOutputter.createDTDParser(SAXOutputter.java:1356)
    	at org.jdom.output.SAXOutputter.dtdEvents(SAXOutputter.java:771)
    	at org.jdom.output.SAXOutputter.output(SAXOutputter.java:607)
    	at org.jdom.transform.JDOMSource$DocumentReader.parse(JDOMSource.java:476)
    	... 49 more
    Caused by: org.xml.sax.SAXException: SAX2 driver class org.apache.xerces.parsers.SAXParser not found
    java.lang.ClassNotFoundException: Illegal access: this web application instance has been stopped already. Could not load [org.apache.xerces.parsers.SAXParser]. The following stack trace is thrown for debugging purposes as well as to attempt to terminate the thread which caused the illegal access.
    	at org.xml.sax.helpers.XMLReaderFactory.loadClass(XMLReaderFactory.java:230)
    	at org.xml.sax.helpers.XMLReaderFactory.createXMLReader(XMLReaderFactory.java:221)
    	at org.jdom.output.SAXOutputter.createParser(SAXOutputter.java:1330)
    	at org.jdom.output.SAXOutputter.createDTDParser(SAXOutputter.java:1353)
    	... 52 more
    Caused by: java.lang.ClassNotFoundException: Illegal access: this web application instance has been stopped already. Could not load [org.apache.xerces.parsers.SAXParser]. The following stack trace is thrown for debugging purposes as well as to attempt to terminate the thread which caused the illegal access.
    	at org.apache.catalina.loader.WebappClassLoaderBase.checkStateForClassLoading(WebappClassLoaderBase.java:1375)
    	at org.apache.catalina.loader.WebappClassLoaderBase.loadClass(WebappClassLoaderBase.java:1226)
    	at org.apache.catalina.loader.WebappClassLoaderBase.loadClass(WebappClassLoaderBase.java:1188)
    	at org.xml.sax.helpers.NewInstance.newInstance(NewInstance.java:82)
    	at org.xml.sax.helpers.XMLReaderFactory.loadClass(XMLReaderFactory.java:228)
    	... 55 more
    Caused by: java.lang.IllegalStateException: Illegal access: this web application instance has been stopped already. Could not load [org.apache.xerces.parsers.SAXParser]. The following stack trace is thrown for debugging purposes as well as to attempt to terminate the thread which caused the illegal access.
    	at org.apache.catalina.loader.WebappClassLoaderBase.checkStateForResourceLoading(WebappClassLoaderBase.java:1385)
    	at org.apache.catalina.loader.WebappClassLoaderBase.checkStateForClassLoading(WebappClassLoaderBase.java:1373)
    	... 59 more
    [2021-10-07 09:41:29,321][ERROR][default.com.arcsight.common.dynachannel.SlidingQueryDynaChannelImpl] 
    java.lang.NullPointerException
    [2021-10-07 09:41:29,321][INFO ][default.com.arcsight.common.persist.CachingSecurityEventBroker] Events requested: 116. Found in cache: 116 in 0 ms.
    [2021-10-07 09:41:30,640][INFO ][default.com.arcsight.server.search.SearchService] Unregistered searchServiceRequestListener
    [2021-10-07 09:41:30,641][INFO ][default.com.arcsight.server.a4] Completed.
    [2021-10-07 09:41:30,643][INFO ][default.com.arcsight.util.host.HostSystemInfoProviderImplLinux$StatCollectorThread] Stopped explicitly.
    [2021-10-07 09:41:31,330][INFO ][default.com.arcsight.notification.NotifierBase$AckCheckTask] No unacknowledged notifications
    [2021-10-07 09:41:34,423][INFO ][default.com.arcsight.rulesengine.opsj.OPSJRulesEngine] Time to build checkpoint: RuleSets 0 Working Memory 0 Trackers 10 Total 10
    [2021-10-07 09:41:34,423][INFO ][default.com.arcsight.rulesengine.b.a] Taking a checkpoint of type Regular CheckPoint
    [2021-10-07 09:41:34,426][INFO ][default.com.arcsight.rulesengine.b.a] Time Taken for the checkpoint = 15 size = 946959
    [2021-10-07 09:41:34,451][INFO ][default.com.arcsight.server.dashboard.checkpoint.DataMonitorCheckpointManager] Data Monitor checkpoint completed: 25 msec. for 171 data monitors
    [2021-10-07 09:41:34,454][INFO ][default.com.arcsight.agent.m.c] Closing cache [SecurityEventBroker].
    [2021-10-07 09:41:34,455][INFO ][default.com.arcsight.agent.m.c] Cache [SecurityEventBroker] closed.
    [2021-10-07 09:41:34,456][INFO ][default.com.arcsight.server.filestore.FileChannelStore] 8AeBanUBABCACVl0KXniuw==.1Y8QNbHUBABCAG8GHovLLOg==:  shutting down...
    [2021-10-07 09:41:34,456][INFO ][default.com.arcsight.server.filestore.FileChannelStore] 8AeBanUBABCACVl0KXniuw==.1Y8QNbHUBABCAG8GHovLLOg==: ...done shutting down
    [2021-10-07 09:41:34,457][INFO ][default.com.arcsight.server.bk] Shutdown Completed.

  • <CODE MAP: '7.3.0.2662.0'>
    <ArcSight Version: 7.3.0.2662.0>
    Network: hostname=Alena4.csobleasing.cz, fqdn=Alena4.csobleasing.cz, configured addresses=[10.146.1.75], configured interfaces=[ens192:[10.146.1.75]], java.net.preferIPv4Stack=false (default value; can reach pure-IPv6 hosts), java.net.preferIPv6Addresses=false (default value)
    [2021-10-07 09:41:29,266][ERROR][default.com.arcsight.tools.query.QueryParser] <Query TimeZone="Europe/Prague">
      <FromClause>
        <Table Alias="event1" Name="Event" />
      </FromClause>
      <SelectClause>
        <SelectColumn>
          <Variable TableAlias="event1" Column="eventId" />
        </SelectColumn>
      </SelectClause>
      <WhereClause>
        <Condition ConditionType="Positive" TableAlias="event1">
          <And TableAlias="event1">
            <And TableAlias="event1">
              <ConstantCondition True="Yes" />
              <BasicCondition Operator="StartsWith" Negated="No" IgnoreCase="No" JoinCondition="No" ListCompare="ANY">
                <Variable Column="name" />
                <Value>[Alert]</Value>
              </BasicCondition>
              <BasicCondition Operator="NE" Negated="No" IgnoreCase="No" JoinCondition="No" ListCompare="ANY">
                <Variable Column="deviceHostName" />
                <Value>VltavaACb-New.csoblacc.int</Value>
              </BasicCondition>
              <BasicCondition Operator="NE" Negated="No" IgnoreCase="No" JoinCondition="No" ListCompare="ANY">
                <Variable Column="deviceHostName" />
                <Value>VltavaACa-New.csoblacc.int</Value>
              </BasicCondition>
              <Or TableAlias="event1">
                <BasicCondition Operator="Is" Negated="No" IgnoreCase="No" JoinCondition="No" ListCompare="ANY">
                  <Variable Column="sessionId" />
                  <Value>NULL</Value>
                </BasicCondition>
                <BasicCondition Operator="EQ" Negated="No" IgnoreCase="No" JoinCondition="No" ListCompare="ANY">
                  <Variable Column="sessionId" />
                  <Value>0</Value>
                </BasicCondition>
              </Or>
            </And>
            <And TableAlias="event1">
              <BasicCondition Operator="GE">
                <Variable TableAlias="event1" Column="endTime" />
                <Value>10/04/2021 02:23:00.000 +0200</Value>
              </BasicCondition>
              <BasicCondition Operator="LT">
                <Variable TableAlias="event1" Column="endTime" />
                <Value>10/04/2021 02:24:00.000 +0200</Value>
              </BasicCondition>
            </And>
          </And>
        </Condition>
      </WhereClause>
      <OrderByClause>
        <OrderByColumn Direction="DESC">
          <Variable Column="endTime" TableAlias="event1" />
        </OrderByColumn>
        <OrderByColumn Direction="ASC">
          <Variable Column="eventId" TableAlias="event1" />
        </OrderByColumn>
      </OrderByClause>
    </Query>
    [2021-10-07 09:41:29,266][ERROR][default.com.arcsight.common.dynachannel.QueryIntrospectableBucketizer] 
    com.arcsight.tools.query.ArlTransformationException: org.xml.sax.SAXException: Error in SAX parser allocation: SAX2 driver class org.apache.xerces.parsers.SAXParser not found: Illegal access: this web application instance has been stopped already. Could not load [org.apache.xerces.parsers.SAXParser]. The following stack trace is thrown for debugging purposes as well as to attempt to terminate the thread which caused the illegal access.
    org.jdom.JDOMException: Error in SAX parser allocation: SAX2 driver class org.apache.xerces.parsers.SAXParser not found: Illegal access: this web application instance has been stopped already. Could not load [org.apache.xerces.parsers.SAXParser]. The following stack trace is thrown for debugging purposes as well as to attempt to terminate the thread which caused the illegal access.
    	at com.arcsight.tools.query.QueryParser.translate(QueryParser.java:146)
    	at com.arcsight.tools.query.QueryParser.translate(QueryParser.java:115)
    	at com.arcsight.common.dynachannel.QueryIntrospectableBucketizer.getBucketIdQuery(QueryIntrospectableBucketizer.java:565)
    	at com.arcsight.common.dynachannel.QueryDynaChannelImpl.getSequenceForBucketHelper(QueryDynaChannelImpl.java:423)
    	at com.arcsight.common.dynachannel.QueryDynaChannelImpl.doGetSequenceForBucket(QueryDynaChannelImpl.java:313)
    	at com.arcsight.common.dynachannel.QueryDynaChannelImpl.getSequenceForBucket(QueryDynaChannelImpl.java:286)
    	at com.arcsight.common.persist.oracle.OracleDynaChannelBroker.getSequenceForBucket(OracleDynaChannelBroker.java:198)
    	at com.arcsight.product.esmclient.business.channel.ChannelDataUtil.populateChannelResult(ChannelDataUtil.java:386)
    	at com.arcsight.product.esmclient.business.channel.ChannelDataUtil.createChannelResult(ChannelDataUtil.java:239)
    	at com.arcsight.product.esmclient.service.v1.impl.ChannelServiceImpl.getChannelInfo(ChannelServiceImpl.java:198)
    	at com.arcsight.product.esmclient.service.v1.impl.AccessControlledChannelServiceImpl.getChannelInfo(AccessControlledChannelServiceImpl.java:837)
    	at com.arcsight.product.esmclient.service.v1.gwt.server.ChannelServiceImpl.getChannelInfo(ChannelServiceImpl.java:763)
    	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    	at java.lang.reflect.Method.invoke(Method.java:498)
    	at com.google.gwt.user.server.rpc.RPC.invokeAndEncodeResponse(RPC.java:587)
    	at com.google.gwt.user.server.rpc.RemoteServiceServlet.processCall(RemoteServiceServlet.java:333)
    	at com.google.gwt.user.server.rpc.RemoteServiceServlet.processCall(RemoteServiceServlet.java:303)
    	at com.google.gwt.user.server.rpc.RemoteServiceServlet.processPost(RemoteServiceServlet.java:373)
    	at com.google.gwt.user.server.rpc.AbstractRemoteServiceServlet.doPost(AbstractRemoteServiceServlet.java:62)
    	at javax.servlet.http.HttpServlet.service(HttpServlet.java:660)
    	at javax.servlet.http.HttpServlet.service(HttpServlet.java:741)
    	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:231)
    	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
    	at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53)
    	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
    	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
    	at com.arcsight.coma.servlet.ServerContextFilter.doFilter(ServerContextFilter.java:56)
    	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
    	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
    	at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:202)
    	at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96)
    	at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:541)
    	at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:139)
    	at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)
    	at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74)
    	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343)
    	at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:373)
    	at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)
    	at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:868)
    	at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1590)
    	at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
    	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
    	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
    	at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
    	at java.lang.Thread.run(Thread.java:748)
    Caused by: javax.xml.transform.TransformerException: org.xml.sax.SAXException: Error in SAX parser allocation: SAX2 driver class org.apache.xerces.parsers.SAXParser not found: Illegal access: this web application instance has been stopped already. Could not load [org.apache.xerces.parsers.SAXParser]. The following stack trace is thrown for debugging purposes as well as to attempt to terminate the thread which caused the illegal access.
    org.jdom.JDOMException: Error in SAX parser allocation: SAX2 driver class org.apache.xerces.parsers.SAXParser not found: Illegal access: this web application instance has been stopped already. Could not load [org.apache.xerces.parsers.SAXParser]. The following stack trace is thrown for debugging purposes as well as to attempt to terminate the thread which caused the illegal access.
    	at com.icl.saxon.Builder.build(Builder.java:271)
    	at com.arcsight.tools.query.f.a(f.java:117)
    	at com.arcsight.tools.query.QueryParser.translate(QueryParser.java:140)
    

  • These logs are all in the past, from this morning rather than current, also which log is this from? It's hard to tell without the full picture, are you getting up to date logs for execprocsvc or the manager? or is it not generating anything new?

  • It was from server.log, and last logs are from this morning before upgrade.
    This is server.std.log

    2021-10-07 16:59:16   / _ | ________/ __(_)__ _/ /  / /_
    2021-10-07 16:59:16  / __ |/ __/ __/\ \/ / _ `/ _ \/ __/
    2021-10-07 16:59:16 /_/ |_/_/  \__/___/_/\_, /_//_/\__/
    2021-10-07 16:59:16             Manager /___/ Version 7.5.0.2720.0 (BE2720_2021-04-20T14:01)
    2021-10-07 16:59:16 
    2021-10-07 16:59:16 Copyright (c) 2001-2021 Micro Focus or one of its affiliates.
    2021-10-07 16:59:16 All rights reserved.
    2021-10-07 16:59:16 
    2021-10-07 16:59:16 ArcSight Home: /opt/arcsight/manager
    2021-10-07 16:59:16 Working Directory: /opt/arcsight/manager
    2021-10-07 16:59:16 
    2021-10-07 16:59:16 Cluster ID: default
    2021-10-07 16:59:16 
    2021-10-07 16:59:16 System: CentOS Linux release 7.8.2003 (Core) (amd64), Kernel 3.10.0-1127.19.1.el7.x86_64, 16 CPUs
    2021-10-07 16:59:16 User: arcsight
    2021-10-07 16:59:16 
    2021-10-07 16:59:16 JVM vendor: Azul Systems, Inc.
    2021-10-07 16:59:16 JVM name: OpenJDK 64-Bit Server VM
    2021-10-07 16:59:16 JVM version: 25.282-b08(64 bit)
    2021-10-07 16:59:16 JVM path: /opt/arcsight/java/1.8.0_282/jdk/jre
    2021-10-07 16:59:16 JVM locale: en_US
    2021-10-07 16:59:16 JVM heap: 971.5 Megabytes (745390104/1018691584)
    2021-10-07 16:59:16 
    2021-10-07 16:59:16 AWT: Initializing headless mode...done (18 ms).
    2021-10-07 16:59:16 BLACK LIST EXECUTION RESULTS: 
    2021-10-07 16:59:16 JREVersion: OK
    2021-10-07 16:59:16 Java version is supported: 1.8.0_282
    2021-10-07 16:59:16 com.arcsight.common.InitializationException: Exception initializing 'com.arcsight.server.NGServer': An error occured in configuration. Unable to find requested property 'sun.net.inetaddr.ttl'.
    2021-10-07 16:59:16 	at com.arcsight.common.util.ServerInit.initializeInetAddressCachePolicy(ServerInit.java:487)
    2021-10-07 16:59:16 	at com.arcsight.server.NGServer.initialize(NGServer.java:528)
    2021-10-07 16:59:16 	at com.arcsight.server.NGServer.main(NGServer.java:3336)
    2021-10-07 16:59:16 	at com.arcsight.server.plugins.manager.Service.start(Service.java:37)
    2021-10-07 16:59:16 	at com.arcsight.dm.plugins.core.Application.initializeServices(Application.java:141)
    2021-10-07 16:59:16 	at com.arcsight.dm.plugins.core.Application.run(Application.java:47)
    2021-10-07 16:59:16 	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    2021-10-07 16:59:16 	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    2021-10-07 16:59:16 	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    2021-10-07 16:59:16 	at java.lang.reflect.Method.invoke(Method.java:498)
    2021-10-07 16:59:16 	at org.eclipse.equinox.internal.app.EclipseAppContainer.callMethodWithException(EclipseAppContainer.java:574)
    2021-10-07 16:59:16 	at org.eclipse.equinox.internal.app.EclipseAppHandle.run(EclipseAppHandle.java:196)
    2021-10-07 16:59:16 	at org.eclipse.core.runtime.internal.adaptor.EclipseAppLauncher.runApplication(EclipseAppLauncher.java:110)
    2021-10-07 16:59:16 	at org.eclipse.core.runtime.internal.adaptor.EclipseAppLauncher.start(EclipseAppLauncher.java:79)
    2021-10-07 16:59:16 	at org.eclipse.core.runtime.adaptor.EclipseStarter.run(EclipseStarter.java:368)
    2021-10-07 16:59:16 	at org.eclipse.core.runtime.adaptor.EclipseStarter.run(EclipseStarter.java:179)
    2021-10-07 16:59:16 	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    2021-10-07 16:59:16 	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    2021-10-07 16:59:16 	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    2021-10-07 16:59:16 	at java.lang.reflect.Method.invoke(Method.java:498)
    2021-10-07 16:59:16 	at org.eclipse.equinox.launcher.Main.invokeFramework(Main.java:559)
    2021-10-07 16:59:16 	at org.eclipse.equinox.launcher.Main.basicRun(Main.java:514)
    2021-10-07 16:59:16 	at org.eclipse.equinox.launcher.Main.run(Main.java:1311)
    2021-10-07 16:59:16 	at org.eclipse.equinox.launcher.Main.main(Main.java:1287)
    2021-10-07 16:59:16 Caused by: com.arcsight.common.config.PropertyNotFoundException: An error occured in configuration. Unable to find requested property 'sun.net.inetaddr.ttl'.
    2021-10-07 16:59:16 	at com.arcsight.common.config.PropertiesFileConfiguration.getPropertyValue(PropertiesFileConfiguration.java:400)
    2021-10-07 16:59:16 	at com.arcsight.common.util.ServerInit.initializeInetAddressCachePolicy(ServerInit.java:485)
    2021-10-07 16:59:16 	... 23 more
    2021-10-07 16:59:16 com.arcsight.common.InitializationException: Exception initializing 'com.arcsight.server.NGServer': An error occured in configuration. Unable to find requested property 'sun.net.inetaddr.ttl'.
    2021-10-07 16:59:16 	at com.arcsight.common.util.ServerInit.initializeInetAddressCachePolicy(ServerInit.java:487)
    2021-10-07 16:59:16 	at com.arcsight.server.NGServer.initialize(NGServer.java:528)
    2021-10-07 16:59:16 	at com.arcsight.server.NGServer.main(NGServer.java:3336)
    2021-10-07 16:59:16 	at com.arcsight.server.plugins.manager.Service.start(Service.java:37)
    2021-10-07 16:59:16 	at com.arcsight.dm.plugins.core.Application.initializeServices(Application.java:141)
    2021-10-07 16:59:16 	at com.arcsight.dm.plugins.core.Application.run(Application.java:47)
    2021-10-07 16:59:16 	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    2021-10-07 16:59:16 	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    2021-10-07 16:59:16 	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    2021-10-07 16:59:16 	at java.lang.reflect.Method.invoke(Method.java:498)
    2021-10-07 16:59:16 	at org.eclipse.equinox.internal.app.EclipseAppContainer.callMethodWithException(EclipseAppContainer.java:574)
    2021-10-07 16:59:16 	at org.eclipse.equinox.internal.app.EclipseAppHandle.run(EclipseAppHandle.java:196)
    2021-10-07 16:59:16 	at org.eclipse.core.runtime.internal.adaptor.EclipseAppLauncher.runApplication(EclipseAppLauncher.java:110)
    2021-10-07 16:59:16 	at org.eclipse.core.runtime.internal.adaptor.EclipseAppLauncher.start(EclipseAppLauncher.java:79)
    2021-10-07 16:59:16 	at org.eclipse.core.runtime.adaptor.EclipseStarter.run(EclipseStarter.java:368)
    2021-10-07 16:59:16 	at org.eclipse.core.runtime.adaptor.EclipseStarter.run(EclipseStarter.java:179)
    2021-10-07 16:59:16 	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    2021-10-07 16:59:16 	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    2021-10-07 16:59:16 	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    2021-10-07 16:59:16 	at java.lang.reflect.Method.invoke(Method.java:498)
    2021-10-07 16:59:16 	at org.eclipse.equinox.launcher.Main.invokeFramework(Main.java:559)
    2021-10-07 16:59:16 	at org.eclipse.equinox.launcher.Main.basicRun(Main.java:514)
    2021-10-07 16:59:16 	at org.eclipse.equinox.launcher.Main.run(Main.java:1311)
    2021-10-07 16:59:16 	at org.eclipse.equinox.launcher.Main.main(Main.java:1287)
    2021-10-07 16:59:16 Caused by: com.arcsight.common.config.PropertyNotFoundException: An error occured in configuration. Unable to find requested property 'sun.net.inetaddr.ttl'.
    2021-10-07 16:59:16 	at com.arcsight.common.config.PropertiesFileConfiguration.getPropertyValue(PropertiesFileConfiguration.java:400)
    2021-10-07 16:59:16 	at com.arcsight.common.util.ServerInit.initializeInetAddressCachePolicy(ServerInit.java:485)
    2021-10-07 16:59:16 	... 23 more
    2021-10-07 16:59:16 
    2021-10-07 16:59:16 Unable to initialize server: com.arcsight.common.InitializationException: Exception initializing 'com.arcsight.server.NGServer': An error occured in configuration. Unable to find requested property 'sun.net.inetaddr.ttl'.
    2021-10-07 16:59:16 Exiting...
    2021-10-07 16:59:16 
    2021-10-07 16:59:16,192 INFO  [Thread-4]  - Closing com.arcsight.coma.spring.ConfigurableWebApplicationContext@387a8303: startup date [Thu Oct 07 16:58:47 CEST 2021]; root of context hierarchy
    2021-10-07 16:59:16,193 INFO  [Thread-4]  - Destroying singletons in org.springframework.beans.factory.support.DefaultListableBeanFactory@70f59913: defining beans [org.springframework.context.annotation.internalConfigurationAnnotationProcessor,org.springframework.context.annotation.internalAutowiredAnnotationProcessor,org.springframework.context.annotation.internalRequiredAnnotationProcessor,org.springframework.context.annotation.internalCommonAnnotationProcessor,org.springframework.context.annotation.internalPersistenceAnnotationProcessor,esmRequestListener,userDao,settingsManager,SSLConfigurationHandler,SSLConfigurationService,FIPSPasswordHandler,FIPSPasswordService,OSPSettingsHandler,OSPSettingsService,authenticationService,authorizationService,sessionStore,sessionService,v1LoginService,v1AccessControlledLoginService,fileHttpRequestHandler,Axis2-v1AccessControlledLoginService,Rest-v1LoginService,Rest-JAXBContextResolver,org.springframework.context.annotation.ConfigurationClassPostProcessor.importAwareProcessor]; root of factory hierarchy
    2021-10-07 16:59:16 (31490ms / 77990000000ns) Current process CPU time: 0.44ms over 5000ms
    2021-10-07 16:59:17,236 INFO  [Thread-4]  - Closing Root WebApplicationContext: startup date [Thu Oct 07 16:58:59 CEST 2021]; root of context hierarchy
    2021-10-07 16:59:17,238 INFO  [Thread-4]  - Destroying singletons in org.springframework.beans.factory.support.DefaultListableBeanFactory@12039ae0: defining beans [org.springframework.context.annotation.internalConfigurationAnnotationProcessor,org.springframework.context.annotation.internalAutowiredAnnotationProcessor,org.springframework.context.annotation.internalRequiredAnnotationProcessor,org.springframework.context.annotation.internalCommonAnnotationProcessor,org.springframework.context.annotation.internalPersistenceAnnotationProcessor,esmRequestListener,authenticationService,authorizationService,sessionService,sessionServiceProvider,v1ResourceReferenceService,v1CaseService,v1ResourceService,v1GroupService,v1UserService,v1SecurityEventService,v1ActiveListService,v1NetworkService,v1ConnectorService,v1FileService,v1FieldSetService,v1DrilldownService,v1DrilldownListService,v1QueryViewerService,v1LicenseService,v1AccessController,v1ServiceDateMapper,authTokenSecurityManager,authTokenSecurityFilter,headersWriter,headerWriterFilter,arcsightAuthEntryPoint,exceptionTranslationFilter,filterChainProxy,org.springframework.security.filterChains,org.springframework.security.filterChainProxy,org.springframework.security.web.PortMapperImpl#0,org.springframework.security.web.PortResolverImpl#0,org.springframework.security.authentication.ProviderManager#0,org.springframework.security.web.context.NullSecurityContextRepository#0,org.springframework.security.web.savedrequest.NullRequestCache#0,org.springframework.security.web.access.expression.DefaultWebSecurityExpressionHandler#0,org.springframework.security.access.vote.AffirmativeBased#0,org.springframework.security.web.access.intercept.FilterSecurityInterceptor#0,org.springframework.security.web.access.DefaultWebInvocationPrivilegeEvaluator#0,org.springframework.security.authentication.AnonymousAuthenticationProvider#0,org.springframework.security.userDetailsServiceFactory,org.springframework.security.web.DefaultSecurityFilterChain#0,fileHttpRequestHandler,Rest-v1CaseService,Rest-v1ResourceService,Rest-v1ConnectorService,Rest-v1UserService,Rest-v1SecurityEventService,Rest-v1ActiveListService,Rest-v1GroupService,Rest-v1FileService,Rest-v1QueryViewerService,Rest-v1LicenseService,Rest-JAXBContextResolver,Rest-AllResources,org.springframework.context.annotation.ConfigurationClassPostProcessor.importAwareProcessor]; root of factory hierarchy
    2021-10-07 16:59:17,247 INFO  [Thread-4]  - Closing Root WebApplicationContext: startup date [Thu Oct 07 16:58:51 CEST 2021]; root of context hierarchy
    2021-10-07 16:59:17,248 INFO  [Thread-4]  - Destroying singletons in org.springframework.beans.factory.support.DefaultListableBeanFactory@5c8b10b4: defining beans [org.springframework.context.annotation.internalConfigurationAnnotationProcessor,org.springframework.context.annotation.internalAutowiredAnnotationProcessor,org.springframework.context.annotation.internalRequiredAnnotationProcessor,org.springframework.context.annotation.internalCommonAnnotationProcessor,org.springframework.context.annotation.internalPersistenceAnnotationProcessor,esmRequestListener,authenticationService,authorizationService,sessionService,sessionServiceProvider,v1InfoService,v1AccessControlledInfoService,v1ManagerSearchService,v1AccessControlledManagerSearchService,v1ResourceReferenceService,v1DashboardService,v1AccessControlledDashboardService,v1ResourceService,v1AccessControlledResourceService,v1PortletService,v1AccessControlledPortletService,v1ViewerConfigurationService,v1AccessControlledViewerConfigurationService,v1DataMonitorQoSService,v1AccessControlledDataMonitorQoSService,v1DataMonitorService,v1AccessControlledDataMonitorService,v1FieldSetService,v1AccessControlledFieldSetService,v1QueryViewerService,v1AccessControlledQueryViewerService,v1DrilldownListService,v1AccessControlledDrilldownListService,v1DrilldownService,v1AccessControlledDrilldownService,v1FileResourceService,v1AccessControlledFileResourceService,v1QueryService,v1AccessControlledQueryService,v1ConAppService,v1AccessControlledConAppService,v1ReportService,v1AccessControlledReportService,v1ArchiveReportService,v1AccessControlledArchiveReportService,v1CaseService,v1AccessControlledCaseService,v1GroupService,v1AccessControlledGroupService,v1InternalService,v1AccessControlledInternalService,v1UserResourceService,v1AccessControlledUserResourceService,v1NetworkService,v1AccessControlledNetworkService,v1ConnectorService,v1AccessControlledConnectorService,v1ManagerAuthenticationService,v1AccessControlledManagerAuthenticationService,v1ServerConfigurationService,v1AccessControlledServerConfigurationService,v1GraphService,v1AccessControlledGraphService,v1SecurityEventService,v1AccessControlledSecurityEventService,v1SecurityEventIntrospectorService,v1AccessControlledSecurityEventIntrospectorService,v1ServiceDateMapper,v1ActiveListService,v1AccessControlledActiveListService,fileHttpRequestHandler,Axis2-v1AccessControlledActiveListService,Axis2-v1AccessControlledArchiveReportService,Axis2-v1AccessControlledCaseService,Axis2-v1AccessControlledConAppService,Axis2-v1AccessControlledConnectorService,Axis2-v1AccessControlledDashboardService,Axis2-v1AccessControlledDataMonitorQoSService,Axis2-v1AccessControlledDataMonitorService,Axis2-v1AccessControlledDrilldownListService,Axis2-v1AccessControlledDrilldownService,Axis2-v1AccessControlledFieldSetService,Axis2-v1AccessControlledFileResourceService,Axis2-v1AccessControlledGraphService,Axis2-v1AccessControlledGroupService,Axis2-v1AccessControlledInternalService,Axis2-v1AccessControlledManagerAuthenticationService,Axis2-v1AccessControlledNetworkService,Axis2-v1AccessControlledPortletService,Axis2-v1AccessControlledQueryService,Axis2-v1AccessControlledQueryViewerService,Axis2-v1AccessControlledReportService,Axis2-v1AccessControlledResourceService,Axis2-v1AccessControlledSecurityEventIntrospectorService,Axis2-v1AccessControlledSecurityEventService,Axis2-v1AccessControlledServerConfigurationService,Axis2-v1AccessControlledUserResourceService,Axis2-v1AccessControlledViewerConfigurationService,Axis2-v1AccessControlledInfoService,Axis2-v1AccessControlledManagerSearchService,Rest-v1ActiveListService,Rest-v1ArchiveReportService,Rest-v1CaseService,Rest-v1ConAppService,Rest-v1ConnectorService,Rest-v1DashboardService,Rest-v1DataMonitorQoSService,Rest-v1DataMonitorService,Rest-v1DrilldownListService,Rest-v1DrilldownService,Rest-v1FieldSetService,Rest-v1FileResourceService,Rest-v1GraphService,Rest-v1GroupService,Rest-v1InternalService,Rest-v1ManagerAuthenticationService,Rest-v1NetworkService,Rest-v1PortletService,Rest-v1QueryService,Rest-v1QueryViewerService,Rest-v1ReportService,Rest-v1ResourceService,Rest-v1SecurityEventIntrospectorService,Rest-v1SecurityEventService,Rest-v1ServerConfigurationService,Rest-v1UserResourceService,Rest-v1ViewerConfigurationService,Rest-v1InfoService,Rest-v1ManagerSearchService,org.springframework.context.annotation.ConfigurationClassPostProcessor.importAwareProcessor]; root of factory hierarchy
    2021-10-07 16:59:17,259 INFO  [Thread-4]  - Closing Root WebApplicationContext: startup date [Thu Oct 07 16:59:03 CEST 2021]; root of context hierarchy
    2021-10-07 16:59:17,260 INFO  [Thread-4]  - Destroying singletons in org.springframework.beans.factory.support.DefaultListableBeanFactory@380cb7e3: defining beans [org.springframework.context.annotation.internalConfigurationAnnotationProcessor,org.springframework.context.annotation.internalAutowiredAnnotationProcessor,org.springframework.context.annotation.internalRequiredAnnotationProcessor,org.springframework.context.annotation.internalCommonAnnotationProcessor,org.springframework.context.annotation.internalPersistenceAnnotationProcessor,esmRequestListener,authenticationService,authorizationService,sessionService,sessionServiceProvider,v2ResourceReferenceService,v2ResourceService,v2GroupService,v2UserService,v2AccessController,v2ServiceDateMapper,authTokenSecurityManager,authTokenSecurityFilter,headersWriter,headerWriterFilter,arcsightAuthEntryPoint,exceptionTranslationFilter,filterChainProxy,org.springframework.security.filterChains,org.springframework.security.filterChainProxy,org.springframework.security.web.PortMapperImpl#0,org.springframework.security.web.PortResolverImpl#0,org.springframework.security.authentication.ProviderManager#0,org.springframework.security.web.context.NullSecurityContextRepository#0,org.springframework.security.web.savedrequest.NullRequestCache#0,org.springframework.security.web.access.expression.DefaultWebSecurityExpressionHandler#0,org.springframework.security.access.vote.AffirmativeBased#0,org.springframework.security.web.access.intercept.FilterSecurityInterceptor#0,org.springframework.security.web.access.DefaultWebInvocationPrivilegeEvaluator#0,org.springframework.security.authentication.AnonymousAuthenticationProvider#0,org.springframework.security.userDetailsServiceFactory,org.springframework.security.web.DefaultSecurityFilterChain#0,fileHttpRequestHandler,Rest-v2UserService,Rest-v2GroupService,Rest-JAXBContextResolver,Rest-AllResources,org.springframework.context.annotation.ConfigurationClassPostProcessor.importAwareProcessor]; root of factory hierarchy
    2021-10-07 16:59:17,267 INFO  [Thread-4]  - Closing Root WebApplicationContext: startup date [Thu Oct 07 16:59:08 CEST 2021]; root of context hierarchy
    2021-10-07 16:59:17,268 INFO  [Thread-4]  - Destroying singletons in org.springframework.beans.factory.support.DefaultListableBeanFactory@77f960ea: defining beans [org.springframework.context.annotation.internalConfigurationAnnotationProcessor,org.springframework.context.annotation.internalAutowiredAnnotationProcessor,org.springframework.context.annotation.internalRequiredAnnotationProcessor,org.springframework.context.annotation.internalCommonAnnotationProcessor,org.springframework.context.annotation.internalPersistenceAnnotationProcessor,esmRequestListener,authenticationService,authorizationService,sessionService,sessionServiceProvider,v1ActiveListService,v1AccessControlledActiveListService,v1ArchiveReportService,v1AccessControlledArchiveReportService,v1ArchiveAndStorageService,v1AccessControlledArchiveAndStorageService,v1CaseService,v1AccessControlledCaseService,v1ChannelService,v1AccessControlledChannelService,v1ChartingDataService,v1AccessControlledChartingDataService,v1ConfigurationManagementService,v1AccessControlledConfigurationManagementService,v1ContentManagementService,v1AccessControlledContentManagementService,v1DashboardService,v1AccessControlledDashboardService,v1DataMonitorV2Service,v1AccessControlledDataMonitorV2Service,v1EventService,v1AccessControlledEventService,v1FieldService,v1AccessControlledFieldService,v1FieldSetService,v1AccessControlledFieldSetService,v1FileDownloadService,v1AccessControlledFileDownloadService,v1FileResourceService,v1AccessControlledFileResourceService,v1FilterService,v1AccessControlledFilterService,v1GroupService,v1AccessControlledGroupService,v1IntegrationCommandService,v1AccessControlledIntegrationCommandService,v1IntegrationConfigurationService,v1AccessControlledIntegrationConfigurationService,v1IntegrationTargetService,v1AccessControlledIntegrationTargetService,v1KnowledgeBaseService,v1AccessControlledKnowledgeBaseService,v1LicenseService,v1AccessControlledLicenseService,v1ManagerMetricsService,v1AccessControlledManagerMetricsService,v1NoteService,v1AccessControlledNoteService,v1NotificationDestinationService,v1AccessControlledNotificationDestinationService,v1PreferenceService,v1AccessControlledPreferenceService,v1QueryViewerV2Service,v1AccessControlledQueryViewerV2Service,v1ReportService,v1AccessControlledReportService,v1ResourceChangeCheckerService,v1AccessControlledResourceChangeCheckerService,v1ResourceReferenceService,v1AccessControlledResourceReferenceService,v1RuleService,v1AccessControlledRuleService,v1SessionListService,v1AccessControlledSessionListService,v1UserService,v1AccessControlledUserService,fileHttpRequestHandler,Axis2-v1AccessControlledActiveListService,Axis2-v1AccessControlledArchiveAndStorageService,Axis2-v1AccessControlledArchiveReportService,Axis2-v1AccessControlledCaseService,Axis2-v1AccessControlledChannelService,Axis2-v1AccessControlledChartingDataService,Axis2-v1AccessControlledConfigurationManagementService,Axis2-v1AccessControlledContentManagementService,Axis2-v1AccessControlledDashboardService,Axis2-v1AccessControlledDataMonitorV2Service,Axis2-v1AccessControlledEventService,Axis2-v1AccessControlledFieldService,Axis2-v1AccessControlledFieldSetService,Axis2-v1AccessControlledFileDownloadService,Axis2-v1AccessControlledFileResourceService,Axis2-v1AccessControlledFilterService,Axis2-v1AccessControlledGroupService,Axis2-v1AccessControlledIntegrationCommandService,Axis2-v1AccessControlledIntegrationConfigurationService,Axis2-v1AccessControlledIntegrationTargetService,Axis2-v1AccessControlledKnowledgeBaseService,Axis2-v1AccessControlledLicenseService,Axis2-v1AccessControlledManagerMetricsService,Axis2-v1AccessControlledNoteService,Axis2-v1AccessControlledNotificationDestinationService,Axis2-v1AccessControlledPreferenceService,Axis2-v1AccessControlledQueryViewerV2Service,Axis2-v1AccessControlledReportService,Axis2-v1AccessControlledResourceChangeCheckerService,Axis2-v1AccessControlledResourceReferenceService,Axis2-v1AccessControlledRuleService,Axis2-v1AccessControlledSessionListService,Axis2-v1AccessControlledUserService,Rest-v1ActiveListService,Rest-v1ArchiveAndStorageService,Rest-v1ArchiveReportService,Rest-v1CaseService,Rest-v1ChannelService,Rest-v1ChartingDataService,Rest-v1ConfigurationManagementService,Rest-v1ContentManagementService,Rest-v1DashboardService,Rest-v1DataMonitorV2Service,Rest-v1EventService,Rest-v1FieldService,Rest-v1FieldSetService,Rest-v1FileDownloadService,Rest-v1FileResourceService,Rest-v1FilterService,Rest-v1GroupService,Rest-v1IntegrationCommandService,Rest-v1IntegrationConfigurationService,Rest-v1IntegrationTargetService,Rest-v1KnowledgeBaseService,Rest-v1LicenseService,Rest-v1ManagerMetricsService,Rest-v1NoteService,Rest-v1NotificationDestinationService,Rest-v1PreferenceService,Rest-v1QueryViewerV2Service,Rest-v1ReportService,Rest-v1ResourceChangeCheckerService,Rest-v1ResourceReferenceService,Rest-v1RuleService,Rest-v1SessionListService,Rest-v1UserService,Rest-JAXBContextResolver,org.springframework.context.annotation.ConfigurationClassPostProcessor.importAwareProcessor]; root of factory hierarchy
    2021-10-07 16:59:26 ArcSight Manager starting...
    2021-10-07 16:59:26 
    2021-10-07 16:59:26 ARCSIGHT_JVM_OPTIONS: -server -Xms1g -Xmx1g -XX:SoftRefLRUPolicyMSPerMB=50 -verbose:gc -XX:+UseParallelOldGC -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/opt/arcsight/var/tmp/manager/heapdump
    2021-10-07 16:59:27 ArcSight Dynamic Module Extender starting...
    2021-10-07 16:59:27 Starting ArcSight DM Framework
    2021-10-07 16:59:27 Arcsight DM Install Home = file:/opt/arcsight/manager/arcsight-dm/
    2021-10-07 16:59:27 Arcsight DM Instance Path = file:/opt/arcsight/manager/workspace/
    2021-10-07 16:59:27 Arcsight DM Services:
    2021-10-07 16:59:27 ArcSight DM Logging Service[com.arcsight.dm.plugins.logging]
    2021-10-07 16:59:27 ArcSight DM Loader Service[com.arcsight.dm.plugins.loader]
    2021-10-07 16:59:27 Tomcat Web Container DM Service[com.arcsight.dm.plugins.tomcatServer]
    2021-10-07 16:59:27 ArcSight ESM Server Core[com.arcsight.bundles.plugins.esmCoreDMService]
    2021-10-07 16:59:27 ArcScript Deploy Service[com.arcsight.bundles.plugins.arcscript]
    2021-10-07 16:59:27 Arcsight DM Starting service ArcSight DM Logging Service[com.arcsight.dm.plugins.logging]
    2021-10-07 16:59:27,270 INFO  [main]  - org.eclipse.core.runtime : com.arcsight.dm.plugins.logging : 0 : Done with re-routing to log4J
    2021-10-07 16:59:27 Arcsight DM Starting service ArcSight DM Loader Service[com.arcsight.dm.plugins.loader]
    2021-10-07 16:59:27,275 INFO  [main]  - org.eclipse.core.runtime : com.arcsight.dm.plugins.loader : 0 : ArcSight DM Application Directory = /opt/arcsight/manager/arcsight-dm//userapps,null
    2021-10-07 16:59:27,275 INFO  [main]  - org.eclipse.core.runtime : com.arcsight.dm.plugins.loader : 0 : Ignore : /opt/arcsight/manager/arcsight-dm/userapps/.empty
    2021-10-07 16:59:27,275 ERROR [main]  - org.eclipse.core.runtime : com.arcsight.dm.plugins.loader : 0 : null is not a directory.
    2021-10-07 16:59:27,275 INFO  [main]  - org.eclipse.core.runtime : com.arcsight.dm.plugins.loader : 0 : ArcSight DM Loader finish installing DM applications
    2021-10-07 16:59:27 Arcsight DM Starting service Tomcat Web Container DM Service[com.arcsight.dm.plugins.tomcatServer]
    2021-10-07 16:59:27,407 WARN  [main]  - [0] Match [Server/Service/Connector] failed to set property [maxSpareThreads] to [30]
    2021-10-07 16:59:27,408 WARN  [main]  - [1] Match [Server/Service/Connector] failed to set property [maxSpareThreads] to [30]
    2021-10-07 16:59:27,423 WARN  [main]  - [2] Match [Server/Service/Engine/Host] failed to set property [liveDeploy] to [false]
    2021-10-07 16:59:27,428 INFO  [main]  - [3] The Apache Tomcat Native library which allows using OpenSSL was not found on the java.library.path: [/opt/arcsight/manager/lib/linux]
    2021-10-07 16:59:27 [GC (Metadata GC Threshold)  120607K->15691K(1005056K), 0.0186785 secs]
    2021-10-07 16:59:27 [Full GC (Metadata GC Threshold)  15691K->14931K(1005056K), 0.0337863 secs]
    2021-10-07 16:59:27,793 INFO  [main]  - [4] Initializing ProtocolHandler ["http-nio-127.0.0.1-9090"]
    2021-10-07 16:59:27,810 INFO  [main]  - [5] Initializing ProtocolHandler ["http-nio-0:0:0:0:0:0:0:1-9090"]
    2021-10-07 16:59:27,811 INFO  [main]  - [6] Server initialization in [523] milliseconds
    2021-10-07 16:59:27,817 FATAL [main]  - [7] No global naming context defined for server
    2021-10-07 16:59:27,818 INFO  [main]  - [8] Starting service [Catalina]
    2021-10-07 16:59:27,818 INFO  [main]  - [9] Starting Servlet engine: [Apache Tomcat/9.0.44]
    2021-10-07 16:59:27,832 INFO  [main]  - [10] Starting ProtocolHandler ["http-nio-127.0.0.1-9090"]
    2021-10-07 16:59:27,838 INFO  [main]  - [11] Starting ProtocolHandler ["http-nio-0:0:0:0:0:0:0:1-9090"]
    2021-10-07 16:59:27,840 INFO  [main]  - [12] Server startup in [29] milliseconds
    2021-10-07 16:59:27,842 WARN  [main]  - Web application /dmconsole has a invalid initLevel null. Default its initLevel to 50.
    2021-10-07 16:59:27,854 INFO  [main]  - org.eclipse.core.runtime : com.arcsight.dm.plugins.tomcatServer : 0 : Starting ArcSight DM Web App  at [/core-service]: DocBase = /opt/arcsight/manager/arcsight-dm/dmapps/core-service-2.2.0/gen/webapp-dm/
    2021-10-07 16:59:28,145 INFO  [main]  - [13] No Spring WebApplicationInitializer types detected on classpath
    2021-10-07 16:59:28,185 INFO  [main]  - [14] At least one JAR was scanned for TLDs yet contained no TLDs. Enable debug logging for this logger for a complete list of JARs that were scanned but no TLDs were found in them. Skipping unneeded JARs during scanning can improve startup time and JSP compilation time.
    2021-10-07 16:59:28,243 INFO  [main]  - Initializing Configurable Spring ApplicationContext
    2021-10-07 16:59:28,255 INFO  [main]  - [15] Initializing Configurable ArcSight Spring ApplicationContext
    2021-10-07 16:59:28,288 INFO  [main]  - Refreshing com.arcsight.coma.spring.ConfigurableWebApplicationContext@387a8303: startup date [Thu Oct 07 16:59:28 CEST 2021]; root of context hierarchy
    2021-10-07 16:59:28,314 INFO  [main]  - Loading XML bean definitions from file [/opt/arcsight/manager/config/ext/core-service/applicationContext.xml]
    2021-10-07 16:59:28 [GC (Allocation Failure)  277075K->25667K(1005056K), 0.0133968 secs]
    2021-10-07 16:59:28,576 INFO  [main]  - Loading XML bean definitions from file [/opt/arcsight/manager/config/ext/core-service/spring.xml]
    2021-10-07 16:59:28,651 INFO  [main]  - Loading XML bean definitions from file [/opt/arcsight/manager/config/ext/core-service/spring-env-production.xml]
    2021-10-07 16:59:28,788 INFO  [main]  - JSR-330 'javax.inject.Inject' annotation found and supported for autowiring
    2021-10-07 16:59:28,801 INFO  [main]  - Pre-instantiating singletons in org.springframework.beans.factory.support.DefaultListableBeanFactory@70f59913: defining beans [org.springframework.context.annotation.internalConfigurationAnnotationProcessor,org.springframework.context.annotation.internalAutowiredAnnotationProcessor,org.springframework.context.annotation.internalRequiredAnnotationProcessor,org.springframework.context.annotation.internalCommonAnnotationProcessor,org.springframework.context.annotation.internalPersistenceAnnotationProcessor,esmRequestListener,userDao,settingsManager,SSLConfigurationHandler,SSLConfigurationService,FIPSPasswordHandler,FIPSPasswordService,OSPSettingsHandler,OSPSettingsService,authenticationService,authorizationService,sessionStore,sessionService,v1LoginService,v1AccessControlledLoginService,fileHttpRequestHandler,Axis2-v1AccessControlledLoginService,Rest-v1LoginService,Rest-JAXBContextResolver,org.springframework.context.annotation.ConfigurationClassPostProcessor.importAwareProcessor]; root of factory hierarchy
    2021-10-07 16:59:29 Register service core-service-AuthenticationService
    2021-10-07 16:59:29 Register service core-service-SessionService
    2021-10-07 16:59:29,333 INFO  [SessionCleaner Thread]  - waiting for WebApplicationContext initialization to complete...
    2021-10-07 16:59:29 Register service core-service-AuthorizationService
    2021-10-07 16:59:29 Register service core-service-LoginService
    2021-10-07 16:59:29,833 INFO  [main]  - ArcSight ApplicationContext: initialization completed in 1577 ms
    2021-10-07 16:59:29,836 INFO  [main]  - No system locale set.
    2021-10-07 16:59:30 [GC (Metadata GC Threshold)  168917K->32300K(1005056K), 0.0240966 secs]
    2021-10-07 16:59:30 [Full GC (Metadata GC Threshold)  32300K->24071K(1005056K), 0.0442964 secs]
    2021-10-07 16:59:30,426 INFO  [main]  - FIPS Startup Listener Context Initialized.
    2021-10-07 16:59:30,450 INFO  [main]  - Could not find axis2.xml, loading default org/apache/axis2/deployment/axis2_default.xml from classpath
    2021-10-07 16:59:30,571 INFO  [main]  - No modules directory was found under /opt/arcsight/manager/arcsight-dm/dmapps/core-service-2.2.0/gen/webapp-dm/WEB-INF.
    2021-10-07 16:59:30,727 INFO  [main]  - Deploying Web service: WebServices
    2021-10-07 16:59:31,447 INFO  [main]  - org.eclipse.core.runtime : com.arcsight.dm.plugins.tomcatServer : 0 : Starting ArcSight DM Web App  at [/dmconsole]: DocBase = /opt/arcsight/manager/arcsight-dm/plugins/com.arcsight.dm.plugins.dmWebConsole_1.0.0/webapp/
    2021-10-07 16:59:31,680 INFO  [main]  - [16] At least one JAR was scanned for TLDs yet contained no TLDs. Enable debug logging for this logger for a complete list of JARs that were scanned but no TLDs were found in them. Skipping unneeded JARs during scanning can improve startup time and JSP compilation time.
    2021-10-07 16:59:31,690 INFO  [main]  - org.eclipse.core.runtime : com.arcsight.dm.plugins.tomcatServer : 0 : Starting ArcSight DM Web App  at [/osp]: DocBase = /opt/arcsight/manager/arcsight-dm/dmapps/core-osp-service-2.1.0/gen/webapp-dm/
    2021-10-07 16:59:31 [GC (Allocation Failure)  286215K->53234K(1005056K), 0.0282438 secs]
    2021-10-07 16:59:31,777 INFO  [main]  - [17] At least one JAR was scanned for TLDs yet contained no TLDs. Enable debug logging for this logger for a complete list of JARs that were scanned but no TLDs were found in them. Skipping unneeded JARs during scanning can improve startup time and JSP compilation time.
    2021-10-07 16:59:31 Cleaning up temporary osp configuration/resource files.
    2021-10-07 16:59:31 Starting initialization of device 03e1c0ce-b5a4-4ffc-be83-ccc9e861aa91 using server version: 6.4.1 2020-06-12T19:56:29Z
    2021-10-07 16:59:31 OSP version: 6.4.1 2020-06-12T19:56:29Z
    2021-10-07 16:59:31,951 FATAL [main]  - [18] For security constraints with URL pattern [/*] the HTTP methods [HEAD] are uncovered.
    2021-10-07 16:59:31,955 INFO  [main]  - org.eclipse.core.runtime : com.arcsight.dm.plugins.tomcatServer : 0 : Starting ArcSight DM Web App  at [/manager-service]: DocBase = /opt/arcsight/manager/arcsight-dm/dmapps/manager-service-1.9.0/gen/webapp-dm/
    2021-10-07 16:59:32,198 INFO  [main]  - [19] At least one JAR was scanned for TLDs yet contained no TLDs. Enable debug logging for this logger for a complete list of JARs that were scanned but no TLDs were found in them. Skipping unneeded JARs during scanning can improve startup time and JSP compilation time.
    2021-10-07 16:59:32,199 INFO  [main]  - Initializing Configurable Spring ApplicationContext
    2021-10-07 16:59:32,199 INFO  [main]  - [20] Initializing Configurable ArcSight Spring ApplicationContext
    2021-10-07 16:59:32,199 INFO  [main]  - [21] Parameter alternateConfigLocation path /opt/arcsight/manager/config/ext/manager-service/applicationContext.xml can not be found; skip initializing ArcSigh Spring ApplicationContext
    2021-10-07 16:59:32,234 INFO  [main]  - [22] Initializing Spring root WebApplicationContext
    2021-10-07 16:59:32,234 INFO  [main]  - Root WebApplicationContext: initialization started
    2021-10-07 16:59:32,272 INFO  [main]  - Refreshing Root WebApplicationContext: startup date [Thu Oct 07 16:59:32 CEST 2021]; root of context hierarchy
    2021-10-07 16:59:32,280 INFO  [main]  - Loading XML bean definitions from ServletContext resource [/WEB-INF/applicationContext.xml]
    2021-10-07 16:59:32,318 INFO  [main]  - Loading XML bean definitions from ServletContext resource [/WEB-INF/spring.xml]
    2021-10-07 16:59:32,334 INFO  [main]  - Loading XML bean definitions from ServletContext resource [/WEB-INF/spring-env-production.xml]
    2021-10-07 16:59:32,570 INFO  [main]  - JSR-330 'javax.inject.Inject' annotation found and supported for autowiring
    2021-10-07 16:59:32,589 INFO  [main]  - Pre-instantiating singletons in org.springframework.beans.factory.support.DefaultListableBeanFactory@5c8b10b4: defining beans [org.springframework.context.annotation.internalConfigurationAnnotationProcessor,org.springframework.context.annotation.internalAutowiredAnnotationProcessor,org.springframework.context.annotation.internalRequiredAnnotationProcessor,org.springframework.context.annotation.internalCommonAnnotationProcessor,org.springframework.context.annotation.internalPersistenceAnnotationProcessor,esmRequestListener,authenticationService,authorizationService,sessionService,sessionServiceProvider,v1InfoService,v1AccessControlledInfoService,v1ManagerSearchService,v1AccessControlledManagerSearchService,v1ResourceReferenceService,v1DashboardService,v1AccessControlledDashboardService,v1ResourceService,v1AccessControlledResourceService,v1PortletService,v1AccessControlledPortletService,v1ViewerConfigurationService,v1AccessControlledViewerConfigurationService,v1DataMonitorQoSService,v1AccessControlledDataMonitorQoSService,v1DataMonitorService,v1AccessControlledDataMonitorService,v1FieldSetService,v1AccessControlledFieldSetService,v1QueryViewerService,v1AccessControlledQueryViewerService,v1DrilldownListService,v1AccessControlledDrilldownListService,v1DrilldownService,v1AccessControlledDrilldownService,v1FileResourceService,v1AccessControlledFileResourceService,v1QueryService,v1AccessControlledQueryService,v1ConAppService,v1AccessControlledConAppService,v1ReportService,v1AccessControlledReportService,v1ArchiveReportService,v1AccessControlledArchiveReportService,v1CaseService,v1AccessControlledCaseService,v1GroupService,v1AccessControlledGroupService,v1InternalService,v1AccessControlledInternalService,v1UserResourceService,v1AccessControlledUserResourceService,v1NetworkService,v1AccessControlledNetworkService,v1ConnectorService,v1AccessControlledConnectorService,v1ManagerAuthenticationService,v1AccessControlledManagerAuthenticationService,v1ServerConfigurationService,v1AccessControlledServerConfigurationService,v1GraphService,v1AccessControlledGraphService,v1SecurityEventService,v1AccessControlledSecurityEventService,v1SecurityEventIntrospectorService,v1AccessControlledSecurityEventIntrospectorService,v1ServiceDateMapper,v1ActiveListService,v1AccessControlledActiveListService,fileHttpRequestHandler,Axis2-v1AccessControlledActiveListService,Axis2-v1AccessControlledArchiveReportService,Axis2-v1AccessControlledCaseService,Axis2-v1AccessControlledConAppService,Axis2-v1AccessControlledConnectorService,Axis2-v1AccessControlledDashboardService,Axis2-v1AccessControlledDataMonitorQoSService,Axis2-v1AccessControlledDataMonitorService,Axis2-v1AccessControlledDrilldownListService,Axis2-v1AccessControlledDrilldownService,Axis2-v1AccessControlledFieldSetService,Axis2-v1AccessControlledFileResourceService,Axis2-v1AccessControlledGraphService,Axis2-v1AccessControlledGroupService,Axis2-v1AccessControlledInternalService,Axis2-v1AccessControlledManagerAuthenticationService,Axis2-v1AccessControlledNetworkService,Axis2-v1AccessControlledPortletService,Axis2-v1AccessControlledQueryService,Axis2-v1AccessControlledQueryViewerService,Axis2-v1AccessControlledReportService,Axis2-v1AccessControlledResourceService,Axis2-v1AccessControlledSecurityEventIntrospectorService,Axis2-v1AccessControlledSecurityEventService,Axis2-v1AccessControlledServerConfigurationService,Axis2-v1AccessControlledUserResourceService,Axis2-v1AccessControlledViewerConfigurationService,Axis2-v1AccessControlledInfoService,Axis2-v1AccessControlledManagerSearchService,Rest-v1ActiveListService,Rest-v1ArchiveReportService,Rest-v1CaseService,Rest-v1ConAppService,Rest-v1ConnectorService,Rest-v1DashboardService,Rest-v1DataMonitorQoSService,Rest-v1DataMonitorService,Rest-v1DrilldownListService,Rest-v1DrilldownService,Rest-v1FieldSetService,Rest-v1FileResourceService,Rest-v1GraphService,Rest-v1GroupService,Rest-v1InternalService,Rest-v1ManagerAuthenticationService,Rest-v1NetworkService,Rest-v1PortletService,Rest-v1QueryService,Rest-v1QueryViewerService,Rest-v1ReportService,Rest-v1ResourceService,Rest-v1SecurityEventIntrospectorService,Rest-v1SecurityEventService,Rest-v1ServerConfigurationService,Rest-v1UserResourceService,Rest-v1ViewerConfigurationService,Rest-v1InfoService,Rest-v1ManagerSearchService,org.springframework.context.annotation.ConfigurationClassPostProcessor.importAwareProcessor]; root of factory hierarchy
    2021-10-07 16:59:32 Register service manager-service-InfoService
    2021-10-07 16:59:32 Register service manager-service-ManagerSearchService
    2021-10-07 16:59:33 [GC (Metadata GC Threshold)  246835K->38509K(1005056K), 0.0181052 secs]
    2021-10-07 16:59:33 [Full GC (Metadata GC Threshold)  38509K->27893K(1005056K), 0.1176965 secs]
    2021-10-07 16:59:33 Register service manager-service-DashboardService
    2021-10-07 16:59:33 Register service manager-service-ResourceService
    2021-10-07 16:59:33 Register service manager-service-PortletService
    2021-10-07 16:59:34 Register service manager-service-ViewerConfigurationService
    2021-10-07 16:59:34 Register service manager-service-DataMonitorQoSService
    2021-10-07 16:59:34 Register service manager-service-DataMonitorService
    2021-10-07 16:59:34 Register service manager-service-QueryViewerService
    2021-10-07 16:59:34 Register service manager-service-DrilldownListService
    2021-10-07 16:59:34 Register service manager-service-DrilldownService
    2021-10-07 16:59:34 Register service manager-service-FileResourceService
    2021-10-07 16:59:34 Register service manager-service-QueryService
    2021-10-07 16:59:34 Register service manager-service-ConAppService
    2021-10-07 16:59:34 Register service manager-service-ReportService
    2021-10-07 16:59:34 Register service manager-service-ArchiveReportService
    2021-10-07 16:59:34 Register service manager-service-CaseService
    2021-10-07 16:59:35 Register service manager-service-GroupService
    2021-10-07 16:59:35 Register service manager-service-InternalService
    2021-10-07 16:59:35 Register service manager-service-UserResourceService
    2021-10-07 16:59:35 Register service manager-service-NetworkService
    2021-10-07 16:59:35 Register service manager-service-ConnectorService
    2021-10-07 16:59:35 Register service manager-service-ManagerAuthenticationService
    2021-10-07 16:59:35 Register service manager-service-ServerConfigurationService
    2021-10-07 16:59:35 Register service manager-service-GraphService
    2021-10-07 16:59:35 Register service manager-service-SecurityEventService
    2021-10-07 16:59:35 Register service manager-service-SecurityEventIntrospectorService
    2021-10-07 16:59:35 Register service manager-service-ActiveListService
    2021-10-07 16:59:36 [GC (Allocation Failure)  290037K->58745K(1008128K), 0.0527667 secs]
    2021-10-07 16:59:37,341 INFO  [main]  - Root WebApplicationContext: initialization completed in 5107 ms
    2021-10-07 16:59:37 [GC (Allocation Failure)  338297K->80977K(1013760K), 0.0458418 secs]
    2021-10-07 16:59:38 [GC (Allocation Failure)  360529K->111716K(955392K), 0.0408884 secs]
    2021-10-07 16:59:38 [GC (Allocation Failure)  332900K->116208K(960000K), 0.0161131 secs]
    2021-10-07 16:59:39 [GC (Allocation Failure)  337392K->138732K(973824K), 0.0225435 secs]
    2021-10-07 16:59:39,093 INFO  [main]  - Could not find axis2.xml, loading default org/apache/axis2/deployment/axis2_default.xml from classpath
    2021-10-07 16:59:39,103 INFO  [main]  - No modules directory was found under /opt/arcsight/manager/arcsight-dm/dmapps/manager-service-1.9.0/gen/webapp-dm/WEB-INF.
    2021-10-07 16:59:39 [GC (Allocation Failure)  348652K->151889K(978944K), 0.0373910 secs]
    2021-10-07 16:59:39,499 INFO  [main]  - Deploying Web service: WebServices
    2021-10-07 16:59:39,500 INFO  [main]  - org.eclipse.core.runtime : com.arcsight.dm.plugins.tomcatServer : 0 : Starting ArcSight DM Web App  at [/detect-api]: DocBase = /opt/arcsight/manager/arcsight-dm/dmapps/detect-api-1.1.0/webapp-dm/
    2021-10-07 16:59:39,633 INFO  [main]  - [23] At least one JAR was scanned for TLDs yet contained no TLDs. Enable debug logging for this logger for a complete list of JARs that were scanned but no TLDs were found in them. Skipping unneeded JARs during scanning can improve startup time and JSP compilation time.
    2021-10-07 16:59:39,633 INFO  [main]  - Initializing Configurable Spring ApplicationContext
    2021-10-07 16:59:39,634 INFO  [main]  - [24] Initializing Configurable ArcSight Spring ApplicationContext
    2021-10-07 16:59:39,634 INFO  [main]  - [25] Parameter alternateConfigLocation path /opt/arcsight/manager/config/ext/detect-api/applicationContext.xml can not be found; skip initializing ArcSigh Spring ApplicationContext
    2021-10-07 16:59:39,665 INFO  [main]  - [26] Initializing Spring root WebApplicationContext
    2021-10-07 16:59:39,665 INFO  [main]  - Root WebApplicationContext: initialization started
    2021-10-07 16:59:39,692 INFO  [main]  - Refreshing Root WebApplicationContext: startup date [Thu Oct 07 16:59:39 CEST 2021]; root of context hierarchy
    2021-10-07 16:59:39,693 INFO  [main]  - Loading XML bean definitions from ServletContext resource [/WEB-INF/applicationContext.xml]
    2021-10-07 16:59:39,718 INFO  [main]  - Loading XML bean definitions from ServletContext resource [/WEB-INF/spring.xml]
    2021-10-07 16:59:39,732 INFO  [main]  - Loading XML bean definitions from ServletContext resource [/WEB-INF/spring-env-production.xml]
    2021-10-07 16:59:39,750 INFO  [main]  - Loading XML bean definitions from ServletContext resource [/WEB-INF/spring-security.xml]
    2021-10-07 16:59:39,808 INFO  [main]  - You are running with Spring Security Core 3.2.5.RELEASE
    2021-10-07 16:59:39,815 INFO  [main]  - Spring Security 'config' module version is 3.2.5.RELEASE
    2021-10-07 16:59:39,888 INFO  [main]  - Creating access control expression attribute 'isAuthenticated()' for /rest/**
    2021-10-07 16:59:39,908 INFO  [main]  - Checking sorted filter chain: [Root bean: class [org.springframework.security.web.context.SecurityContextPersistenceFilter]; scope=; abstract=false; lazyInit=false; autowireMode=0; dependencyCheck=0; autowireCandidate=true; primary=false; factoryBeanName=null; factoryMethodName=null; initMethodName=null; destroyMethodName=null, order = 200, Root bean: class [org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter]; scope=; abstract=false; lazyInit=false; autowireMode=0; dependencyCheck=0; autowireCandidate=true; primary=false; factoryBeanName=null; factoryMethodName=null; initMethodName=null; destroyMethodName=null, order = 400, Root bean: class [org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter]; scope=; abstract=false; lazyInit=false; autowireMode=0; dependencyCheck=0; autowireCandidate=true; primary=false; factoryBeanName=null; factoryMethodName=null; initMethodName=null; destroyMethodName=null, order = 1700, Root bean: class [org.springframework.security.web.authentication.AnonymousAuthenticationFilter]; scope=; abstract=false; lazyInit=false; autowireMode=0; dependencyCheck=0; autowireCandidate=true; primary=false; factoryBeanName=null; factoryMethodName=null; initMethodName=null; destroyMethodName=null, order = 2000, Root bean: class [org.springframework.security.web.access.ExceptionTranslationFilter]; scope=; abstract=false; lazyInit=false; autowireMode=0; dependencyCheck=0; autowireCandidate=true; primary=false; factoryBeanName=null; factoryMethodName=null; initMethodName=null; destroyMethodName=null, order = 2200, <org.springframework.security.web.access.intercept.FilterSecurityInterceptor#0>, order = 2300]
    2021-10-07 16:59:39,909 INFO  [main]  - Loading XML bean definitions from ServletContext resource [/WEB-INF/module-application-context.xml]
    2021-10-07 16:59:40,020 INFO  [main]  - JSR-330 'javax.inject.Inject' annotation found and supported for autowiring
    2021-10-07 16:59:40,025 INFO  [main]  - Pre-instantiating singletons in org.springframework.beans.factory.support.DefaultListableBeanFactory@12039ae0: defining beans [org.springframework.context.annotation.internalConfigurationAnnotationProcessor,org.springframework.context.annotation.internalAutowiredAnnotationProcessor,org.springframework.context.annotation.internalRequiredAnnotationProcessor,org.springframework.context.annotation.internalCommonAnnotationProcessor,org.springframework.context.annotation.internalPersistenceAnnotationProcessor,esmRequestListener,authenticationService,authorizationService,sessionService,sessionServiceProvider,v1ResourceReferenceService,v1CaseService,v1ResourceService,v1GroupService,v1UserService,v1SecurityEventService,v1ActiveListService,v1NetworkService,v1ConnectorService,v1FileService,v1FieldSetService,v1DrilldownService,v1DrilldownListService,v1QueryViewerService,v1LicenseService,v1AccessController,v1ServiceDateMapper,authTokenSecurityManager,authTokenSecurityFilter,headersWriter,headerWriterFilter,arcsightAuthEntryPoint,exceptionTranslationFilter,filterChainProxy,org.springframework.security.filterChains,org.springframework.security.filterChainProxy,org.springframework.security.web.PortMapperImpl#0,org.springframework.security.web.PortResolverImpl#0,org.springframework.security.authentication.ProviderManager#0,org.springframework.security.web.context.NullSecurityContextRepository#0,org.springframework.security.web.savedrequest.NullRequestCache#0,org.springframework.security.web.access.expression.DefaultWebSecurityExpressionHandler#0,org.springframework.security.access.vote.AffirmativeBased#0,org.springframework.security.web.access.intercept.FilterSecurityInterceptor#0,org.springframework.security.web.access.DefaultWebInvocationPrivilegeEvaluator#0,org.springframework.security.authentication.AnonymousAuthenticationProvider#0,org.springframework.security.userDetailsServiceFactory,org.springframework.security.web.DefaultSecurityFilterChain#0,fileHttpRequestHandler,Rest-v1CaseService,Rest-v1ResourceService,Rest-v1ConnectorService,Rest-v1UserService,Rest-v1SecurityEventService,Rest-v1ActiveListService,Rest-v1GroupService,Rest-v1FileService,Rest-v1QueryViewerService,Rest-v1LicenseService,Rest-JAXBContextResolver,Rest-AllResources,org.springframework.context.annotation.ConfigurationClassPostProcessor.importAwareProcessor]; root of factory hierarchy
    2021-10-07 16:59:40 [GC (Allocation Failure)  361809K->164108K(982016K), 0.0498420 secs]
    2021-10-07 16:59:41,857 INFO  [main]  - Creating filter chain: Ant [pattern='/rest/swagger.json'], []
    2021-10-07 16:59:41,857 INFO  [main]  - Creating filter chain: Ant [pattern='/rest/**'], [com.arcsight.product.detectapi.security.ArcsightExceptionTranslationFilter@65314e4, org.springframework.security.web.header.HeaderWriterFilter@a93c88a, com.arcsight.product.detectapi.security.AuthTokenFilter@741cb82c]
    2021-10-07 16:59:42,895 INFO  [main]  - Creating filter chain: org.springframework.security.web.util.matcher.AnyRequestMatcher@1, [org.springframework.security.web.context.SecurityContextPersistenceFilter@286e2b71, org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter@6ad4d333, org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter@1b3fff29, org.springframework.security.web.authentication.AnonymousAuthenticationFilter@4f90b4c9, org.springframework.security.web.access.ExceptionTranslationFilter@16fc3be9, org.springframework.security.web.access.intercept.FilterSecurityInterceptor@5afd2f4e]
    2021-10-07 16:59:43,847 INFO  [main]  - Root WebApplicationContext: initialization completed in 4182 ms
    2021-10-07 16:59:44 SLF4J: Failed to load class "org.slf4j.impl.StaticLoggerBinder".
    2021-10-07 16:59:44 SLF4J: Defaulting to no-operation (NOP) logger implementation
    2021-10-07 16:59:44 SLF4J: See http://www.slf4j.org/codes.html#StaticLoggerBinder for further details.
    2021-10-07 16:59:44,181 INFO  [main]  - org.eclipse.core.runtime : com.arcsight.dm.plugins.tomcatServer : 0 : Starting ArcSight DM Web App  at [/scim]: DocBase = /opt/arcsight/manager/arcsight-dm/dmapps/scim-api-1.0.0/webapp-dm/
    2021-10-07 16:59:44 [GC (Allocation Failure)  378124K->181621K(979968K), 0.0620208 secs]
    2021-10-07 16:59:44,369 INFO  [main]  - [27] At least one JAR was scanned for TLDs yet contained no TLDs. Enable debug logging for this logger for a complete list of JARs that were scanned but no TLDs were found in them. Skipping unneeded JARs during scanning can improve startup time and JSP compilation time.
    2021-10-07 16:59:44,370 INFO  [main]  - Initializing Configurable Spring ApplicationContext
    2021-10-07 16:59:44,370 INFO  [main]  - [28] Initializing Configurable ArcSight Spring ApplicationContext
    2021-10-07 16:59:44,370 INFO  [main]  - [29] Parameter alternateConfigLocation path /opt/arcsight/manager/config/ext/scim/applicationContext.xml can not be found; skip initializing ArcSigh Spring ApplicationContext
    2021-10-07 16:59:44,407 INFO  [main]  - [30] Initializing Spring root WebApplicationContext
    2021-10-07 16:59:44,407 INFO  [main]  - Root WebApplicationContext: initialization started
    2021-10-07 16:59:44,442 INFO  [main]  - Refreshing Root WebApplicationContext: startup date [Thu Oct 07 16:59:44 CEST 2021]; root of context hierarchy
    2021-10-07 16:59:44,443 INFO  [main]  - Loading XML bean definitions from ServletContext resource [/WEB-INF/applicationContext.xml]
    2021-10-07 16:59:44,472 INFO  [main]  - Loading XML bean definitions from ServletContext resource [/WEB-INF/spring.xml]
    2021-10-07 16:59:44,485 INFO  [main]  - Loading XML bean definitions from ServletContext resource [/WEB-INF/spring-env-production.xml]
    2021-10-07 16:59:44,502 INFO  [main]  - Loading XML bean definitions from ServletContext resource [/WEB-INF/spring-security.xml]
    2021-10-07 16:59:44,537 INFO  [main]  - You are running with Spring Security Core 3.2.5.RELEASE
    2021-10-07 16:59:44,539 INFO  [main]  - Spring Security 'config' module version is 3.2.5.RELEASE
    2021-10-07 16:59:44,555 INFO  [main]  - Creating access control expression attribute 'isAuthenticated()' for /v2/**
    2021-10-07 16:59:44,563 INFO  [main]  - Checking sorted filter chain: [Root bean: class [org.springframework.security.web.context.SecurityContextPersistenceFilter]; scope=; abstract=false; lazyInit=false; autowireMode=0; dependencyCheck=0; autowireCandidate=true; primary=false; factoryBeanName=null; factoryMethodName=null; initMethodName=null; destroyMethodName=null, order = 200, Root bean: class [org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter]; scope=; abstract=false; lazyInit=false; autowireMode=0; dependencyCheck=0; autowireCandidate=true; primary=false; factoryBeanName=null; factoryMethodName=null; initMethodName=null; destroyMethodName=null, order = 400, Root bean: class [org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter]; scope=; abstract=false; lazyInit=false; autowireMode=0; dependencyCheck=0; autowireCandidate=true; primary=false; factoryBeanName=null; factoryMethodName=null; initMethodName=null; destroyMethodName=null, order = 1700, Root bean: class [org.springframework.security.web.authentication.AnonymousAuthenticationFilter]; scope=; abstract=false; lazyInit=false; autowireMode=0; dependencyCheck=0; autowireCandidate=true; primary=false; factoryBeanName=null; factoryMethodName=null; initMethodName=null; destroyMethodName=null, order = 2000, Root bean: class [org.springframework.security.web.access.ExceptionTranslationFilter]; scope=; abstract=false; lazyInit=false; autowireMode=0; dependencyCheck=0; autowireCandidate=true; primary=false; factoryBeanName=null; factoryMethodName=null; initMethodName=null; destroyMethodName=null, order = 2200, <org.springframework.security.web.access.intercept.FilterSecurityInterceptor#0>, order = 2300]
    2021-10-07 16:59:44,564 INFO  [main]  - Loading XML bean definitions from ServletContext resource [/WEB-INF/module-application-context.xml]
    2021-10-07 16:59:44,652 INFO  [main]  - JSR-330 'javax.inject.Inject' annotation found and supported for autowiring
    2021-10-07 16:59:44,654 INFO  [main]  - Pre-instantiating singletons in org.springframework.beans.factory.support.DefaultListableBeanFactory@380cb7e3: defining beans [org.springframework.context.annotation.internalConfigurationAnnotationProcessor,org.springframework.context.annotation.internalAutowiredAnnotationProcessor,org.springframework.context.annotation.internalRequiredAnnotationProcessor,org.springframework.context.annotation.internalCommonAnnotationProcessor,org.springframework.context.annotation.internalPersistenceAnnotationProcessor,esmRequestListener,authenticationService,authorizationService,sessionService,sessionServiceProvider,v2ResourceReferenceService,v2ResourceService,v2GroupService,v2UserService,v2AccessController,v2ServiceDateMapper,authTokenSecurityManager,authTokenSecurityFilter,headersWriter,headerWriterFilter,arcsightAuthEntryPoint,exceptionTranslationFilter,filterChainProxy,org.springframework.security.filterChains,org.springframework.security.filterChainProxy,org.springframework.security.web.PortMapperImpl#0,org.springframework.security.web.PortResolverImpl#0,org.springframework.security.authentication.ProviderManager#0,org.springframework.security.web.context.NullSecurityContextRepository#0,org.springframework.security.web.savedrequest.NullRequestCache#0,org.springframework.security.web.access.expression.DefaultWebSecurityExpressionHandler#0,org.springframework.security.access.vote.AffirmativeBased#0,org.springframework.security.web.access.intercept.FilterSecurityInterceptor#0,org.springframework.security.web.access.DefaultWebInvocationPrivilegeEvaluator#0,org.springframework.security.authentication.AnonymousAuthenticationProvider#0,org.springframework.security.userDetailsServiceFactory,org.springframework.security.web.DefaultSecurityFilterChain#0,fileHttpRequestHandler,Rest-v2UserService,Rest-v2GroupService,Rest-JAXBContextResolver,Rest-AllResources,org.springframework.context.annotation.ConfigurationClassPostProcessor.importAwareProcessor]; root of factory hierarchy
    2021-10-07 16:59:45,715 INFO  [main]  - Creating filter chain: Ant [pattern='/v2/swagger.json'], []
    2021-10-07 16:59:45,715 INFO  [main]  - Creating filter chain: Ant [pattern='/v2/**'], [com.arcsight.product.scimapi.security.ArcsightExceptionTranslationFilter@7b303608, org.springframework.security.web.header.HeaderWriterFilter@31419d4a, com.arcsight.product.scimapi.security.AuthTokenFilter@220f2d1b]
    2021-10-07 16:59:46,619 INFO  [main]  - Creating filter chain: org.springframework.security.web.util.matcher.AnyRequestMatcher@1, [org.springframework.security.web.context.SecurityContextPersistenceFilter@698d07ac, org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter@62d59d60, org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter@3c532b97, org.springframework.security.web.authentication.AnonymousAuthenticationFilter@5cffd11d, org.springframework.security.web.access.ExceptionTranslationFilter@5d4e0d49, org.springframework.security.web.access.intercept.FilterSecurityInterceptor@13bea51d]
    2021-10-07 16:59:47,132 INFO  [main]  - Root WebApplicationContext: initialization completed in 2725 ms
    2021-10-07 16:59:47 [GC (Allocation Failure)  395637K->180329K(986112K), 0.0467233 secs]
    2021-10-07 16:59:47 SLF4J: Failed to load class "org.slf4j.impl.StaticLoggerBinder".
    2021-10-07 16:59:47 SLF4J: Defaulting to no-operation (NOP) logger implementation
    2021-10-07 16:59:47 SLF4J: See http://www.slf4j.org/codes.html#StaticLoggerBinder for further details.
    2021-10-07 16:59:47,455 INFO  [main]  - org.eclipse.core.runtime : com.arcsight.dm.plugins.tomcatServer : 0 : Starting ArcSight DM Web App  at [/ui-phoenix]: DocBase = /opt/arcsight/manager/arcsight-dm/dmapps/ui-phoenix-1.10.0/dist/www/
    2021-10-07 16:59:47,579 INFO  [main]  - [31] At least one JAR was scanned for TLDs yet contained no TLDs. Enable debug logging for this logger for a complete list of JARs that were scanned but no TLDs were found in them. Skipping unneeded JARs during scanning can improve startup time and JSP compilation time.
    2021-10-07 16:59:47,581 INFO  [main]  - org.eclipse.core.runtime : com.arcsight.dm.plugins.tomcatServer : 0 : Starting ArcSight DM Web App  at [/esmclient-service]: DocBase = /opt/arcsight/manager/arcsight-dm/dmapps/esmclient-service-1.10.0/gen/webapp-dm/
    2021-10-07 16:59:48 [GC (Allocation Failure)  403049K->190444K(984576K), 0.0253682 secs]
    2021-10-07 16:59:48 [GC (Allocation Failure)  413164K->181758K(989696K), 0.0231707 secs]
    2021-10-07 16:59:49 [GC (Allocation Failure)  412158K->204141K(988672K), 0.0260171 secs]
    2021-10-07 16:59:49 [GC (Allocation Failure)  434541K->193327K(991232K), 0.0215290 secs]
    2021-10-07 16:59:50 [GC (Allocation Failure)  425775K->194502K(989184K), 0.0167375 secs]
    2021-10-07 16:59:50,640 INFO  [main]  - [32] At least one JAR was scanned for TLDs yet contained no TLDs. Enable debug logging for this logger for a complete list of JARs that were scanned but no TLDs were found in them. Skipping unneeded JARs during scanning can improve startup time and JSP compilation time.
    2021-10-07 16:59:50,640 INFO  [main]  - Initializing Configurable Spring ApplicationContext
    2021-10-07 16:59:50,641 INFO  [main]  - [33] Initializing Configurable ArcSight Spring ApplicationContext
    2021-10-07 16:59:50,641 INFO  [main]  - [34] Parameter alternateConfigLocation path /opt/arcsight/manager/config/ext/esmclient-service/applicationContext.xml can not be found; skip initializing ArcSigh Spring ApplicationContext
    2021-10-07 16:59:50,661 INFO  [main]  - [35] Initializing Spring root WebApplicationContext
    2021-10-07 16:59:50,661 INFO  [main]  - Root WebApplicationContext: initialization started
    2021-10-07 16:59:50,685 INFO  [main]  - Refreshing Root WebApplicationContext: startup date [Thu Oct 07 16:59:50 CEST 2021]; root of context hierarchy
    2021-10-07 16:59:50,686 INFO  [main]  - Loading XML bean definitions from ServletContext resource [/WEB-INF/applicationContext.xml]
    2021-10-07 16:59:50,713 INFO  [main]  - Loading XML bean definitions from ServletContext resource [/WEB-INF/spring.xml]
    2021-10-07 16:59:50,723 INFO  [main]  - Loading XML bean definitions from ServletContext resource [/WEB-INF/spring-env-production.xml]
    2021-10-07 16:59:50,856 INFO  [main]  - JSR-330 'javax.inject.Inject' annotation found and supported for autowiring
    

  • Anything in the execprocsvc logs? I can't see anything blindingly obvious in that log obviously there is that error at the start but it didn't seem to stop the manager starting, I think if execprocsvc cant start though the manager service also can't start so I have a little suspicion it might be in there that the issue is.

    Have you also raised a support ticket for this?

  • I did not raise ticket yet.
    This is the execprocsvc log: These few error lines are repeating.

    2021-10-07 12:12:36 ArcSight ExecProc starting...
    2021-10-07 12:12:36 
    2021-10-07 12:12:36 ARCSIGHT_JVM_OPTIONS: -Xms32m -Xmx32m -verbose:gc -Dhotspot
    2021-10-07 12:12:36 [GC (Allocation Failure)  8704K->1375K(31744K), 0.0033694 secs]
    2021-10-07 12:12:36 Configuration initialized: config/server.defaults.properties; config/server.properties
    2021-10-07 12:12:36 Cannot initialize logging.
    2021-10-07 12:12:36 com.arcsight.common.InitializationException: Exception initializing 'com.arcsight.common.log.ConsoleLogger': Error accessing configuration. An error occured in configuration. Unable to find requested property 'log.global.debug'.
    2021-10-07 12:12:36 	at com.arcsight.common.log.ConsoleLogger.initLogging(ConsoleLogger.java:172)
    2021-10-07 12:12:36 	at com.arcsight.common.log.ConsoleLogger.initLogging(ConsoleLogger.java:48)
    2021-10-07 12:12:36 	at com.arcsight.tools.process.ProcessExecutorTool.main(ProcessExecutorTool.java:469)
    2021-10-07 12:13:13 ArcSight ExecProc starting...
    2021-10-07 12:13:13 
    2021-10-07 12:13:13 ARCSIGHT_JVM_OPTIONS: -Xms32m -Xmx32m -verbose:gc -Dhotspot
    2021-10-07 12:13:13 [GC (Allocation Failure)  8704K->1373K(31744K), 0.0035367 secs]
    2021-10-07 12:13:13 Configuration initialized: config/server.defaults.properties; config/server.properties
    2021-10-07 12:13:13 Cannot initialize logging.
    2021-10-07 12:13:13 com.arcsight.common.InitializationException: Exception initializing 'com.arcsight.common.log.ConsoleLogger': Error accessing configuration. An error occured in configuration. Unable to find requested property 'log.global.debug'.
    2021-10-07 12:13:13 	at com.arcsight.common.log.ConsoleLogger.initLogging(ConsoleLogger.java:172)
    2021-10-07 12:13:13 	at com.arcsight.common.log.ConsoleLogger.initLogging(ConsoleLogger.java:48)
    2021-10-07 12:13:13 	at com.arcsight.tools.process.ProcessExecutorTool.main(ProcessExecutorTool.java:469)
    2021-10-07 12:13:44 ArcSight ExecProc starting...
    2021-10-07 12:13:44 
    2021-10-07 12:13:44 ARCSIGHT_JVM_OPTIONS: -Xms32m -Xmx32m -verbose:gc -Dhotspot
    2021-10-07 12:13:44 [GC (Allocation Failure)  8704K->1359K(31744K), 0.0032249 secs]
    2021-10-07 12:13:44 Configuration initialized: config/server.defaults.properties; config/server.properties
    2021-10-07 12:13:44 Cannot initialize logging.
    2021-10-07 12:13:44 com.arcsight.common.InitializationException: Exception initializing 'com.arcsight.common.log.ConsoleLogger': Error accessing configuration. An error occured in configuration. Unable to find requested property 'log.global.debug'.
    2021-10-07 12:13:44 	at com.arcsight.common.log.ConsoleLogger.initLogging(ConsoleLogger.java:172)
    2021-10-07 12:13:44 	at com.arcsight.common.log.ConsoleLogger.initLogging(ConsoleLogger.java:48)
    2021-10-07 12:13:44 	at com.arcsight.tools.process.ProcessExecutorTool.main(ProcessExecutorTool.java:469)
    2021-10-07 12:14:15 ArcSight ExecProc starting...
    

  • Hmm same problem here as before, the logs are from earlier today. sorry I know this isn't that helpful but what happens when you try and manually start the services? do you get any sort of error message? I assume not but worth checking.

    I'm guessing the upgrade log didn't show any errors either?

  • The error from execprocsvc is repeated whole day i just copy the first lines. Can be some error in truststore ? I did not done anything with it. Maybe some service cert or something like this ?

  • hmm, can you check you server.properites and server.default.properties for "log.global.debug"?

    Try removing / commenting it out if you have it and restart it. I don't understand why that would be an error though as it is a valid option, but by default its set to false in the defaults.