Thanks for this feedback, Mark, we'll get this on the roadmap.

Here are some suggested minor updates:

p23. Note regarding "To run in Console mode...". Suggest add information to review environment variable DISPLAY. echo $DISPLAY.  If DISPLAY variable has a hostname:0.0 then X Windows will attempt to export display. Use the following command to temporarily remove setting and retry to run in Console mode.

• unset DISPLAY

p49. Case 1 - Suggest adding full path of 

• /opt/arcsight/manager/bin/remove_services.sh

Appendix A: Troubleshooting.  Please add section regarding X Windows. To run in Console mode be sure that environment variable DISPLAY is not set.  echo $DISPLAY.  To temporarily clear the variable use unset DISPLAY.

If the following is seen in the firstbootsetup.log then X windows is not fully disabled.

2015-07-20 13:56:51 -0400  ArcSight First Boot Setup starting in Console mode...

2015-07-20 13:56:51 -0400  Output is in /opt/arcsight/manager/logs/firstbootsetup.log and /opt/arcsight/manager/logs/default/fbwizard.log

Exception in thread "main" java.lang.NoClassDefFoundError: Could not initialize class java.awt.Toolkit

The Java AWT (Abstract Window Toolkit) is attempting to load.  To temporarily clear the variable  and tell Java not to use AWT, use command: unset DISPLAY then rerun the first boot startup.