This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

ArcSight search never completes

I am observing an issue from our ArcSight console when doing any basic search.  From the Analyze > Search page, when you enter a search string and click GO, the search never completes.  The number of scanned events eventually stops incrementing, but the search appears to keep going and never actually stops to indicate it has completed.  You have to manually click the Cancel button every time. This just started happening recently.

We are running HPE ArcSight Logger: 6.3.1.7874.0.  Are there any general issues which can cause this, and what would be a good option to try and fix this?  Unfortunately I don't know a whole lot about this product, and was hoping to find some common things to check/try.

Jim

Parents
  • Can you retrieve the logs from the application? I can't fully recall 6.x logger UI to tell you where it is but in the newer release, it's under Configuration -> Advanced Configuration -> Retrieve Logs. You'll want to go through the logs under "/opt/arcsight/userdata/logger/logs/" I would look in logger_mysqld.log to start for any errors. 

Reply
  • Can you retrieve the logs from the application? I can't fully recall 6.x logger UI to tell you where it is but in the newer release, it's under Configuration -> Advanced Configuration -> Retrieve Logs. You'll want to go through the logs under "/opt/arcsight/userdata/logger/logs/" I would look in logger_mysqld.log to start for any errors. 

Children