Upgrading ArcSight Express 3.0 to ArcSight Express 4.0


Complete instructions for upgrading from ArcSight Express 3.0 to ArcSight Express 4.0.


In the 12/22/14 update: Added instructions about how to handle time zone updates (tzdata) if you are upgrading from an AE 3.0 system that has updated tzdata or Russain DST hotfix RDST201421026 applied to an AE 4.0 system that does not.


In the 5/21/13 update: Clarified the pre-upgrade preparation note with the following statement: "Before you upgrade, verify that your ArcSight Express 3.0 is fully functional and its archives intact. If there is any issue with your ArcSight Express 3.0 system, contact Customer Support before upgrading."


Comment List
  • Check the query, with a query viewer, does that work?

  • Active list values/entries are not populating in report after upgrade to v4.0.

    The report was working fine and collecting values from active lists until the day before upgrade. However, none of the active list value can populate in report after upgrade.

    Anyone tried this?

  • I'm sorry but I don't remember it.
    They sent me a detailed solution to fix the problem.

  • Jane,

    I've resolved the problem with the customer support how you've suggested to me, one month ago.



  • And run update process from server (no putty). For example use VNC.

  • I would suggest first removing the rpm arcsight-ngs-update-4.0-1311

    rpm -e arcsight-ngs-update-4.0-1311

    And then retrying.. Also, if you are trying to upgrade the VM, check you have enough disk space on root.

  • I strongly recommend contacting customer support to help diagnose upgrade failures. I'll direct them to this thread, too, so they're aware of the problem.

  • Hi All,

    I'm trying to upgrade an Express 3.0 versus 4.0, I followed the document and the suggestion of Samer, but the upgrade ends with an error:

    "NOTE: You are about to run this product updater.

    Proceed [y/N]? y

    Details of the update will be written to [/opt/updates/arcsight-express-].

    Applying update...

    Update script finished. Reboot not required.

    [root@arcsight Desktop]# more /opt/updates/arcsight-express-

    [2013-10-29 12:06:35 +0100 updater.pl] stage 0 : Starting preflight check

    [2013-10-29 12:06:36 +0100 updater.pl] X Server check ok.

    [2013-10-29 12:06:38 +0100 updater.pl] All services are up and running.

    [2013-10-29 12:06:38 +0100 updater.pl] About to execute preflight command-script, [sh /opt/updates/arcsight-express-].

    [2013-10-29 12:06:43 +0100 updater.pl] 'Success' was returned from preflight command-script, [sh /opt/updates/arcsight-express-].

    [2013-10-29 12:06:43 +0100 updater.pl] runPreflightChecks(): disk space available [1528.61376953125] GB

    [2013-10-29 12:06:43 +0100 updater.pl] runPreflightChecks(): tmpfs space available [17.6639404296875] GB

    [2013-10-29 12:06:43 +0100 updater.pl] conAppPreflightChecks(): Checking 6005

    [2013-10-29 12:06:43 +0100 updater.pl] conAppPreflightChecks(): Checking 6009

    [2013-10-29 12:06:43 +0100 updater.pl] conAppPreflightChecks(): Checking 6443

    [2013-10-29 12:06:43 +0100 updater.pl] postgresUpgradeBackup(): subroutine beginning...

    [2013-10-29 12:06:43 +0100 updater.pl] postgresUpgradeBackup(): The postgres backup-dump file already exists: [/opt/arcsight/logger/current/arcsight/logger/user/logger/ae4.0Upgrade.dump].

    [2013-10-29 12:06:43 +0100 updater.pl] postgresUpgradeBackup(): Therefore the one now being created will be named, [/opt/arcsight/logger/current/arcsight/logger/user/logger/ae4.0Upgrade.2013-10-29


    [2013-10-29 12:06:43 +0100 updater.pl] postgresUpgradeBackup(): subroutine ending...

    [2013-10-29 12:06:43 +0100 updater.pl] stage 0 : Finished preflight check

    [2013-10-29 12:06:43 +0100 updater.pl] stage 1 : Starting ulimit configuration

    [2013-10-29 12:06:43 +0100 updater.pl] updating ulimit configuration

    [2013-10-29 12:06:43 +0100 updater.pl] stage 1 : Finished ulimit configuration

    [2013-10-29 12:06:43 +0100 updater.pl] stage 2 : Starting scanRpmFiles

    [2013-10-29 12:06:43 +0100 updater.pl] Package already installed: [arcsight-ngs-update-4.0-1311.x86_64.rpm], therefore skipping it.

    [2013-10-29 12:06:43 +0100 updater.pl] Package already installed: [tzdata-2012i-1.noarch.rpm], therefore skipping it.

    [2013-10-29 12:06:43 +0100 updater.pl] stage 2 : Finished scanRpmFiles

    [2013-10-29 12:06:43 +0100 updater.pl] Starting to run command: rpm -Uvv

    rpm: no packages given for install

    [2013-10-29 12:06:43 +0100 updater.pl] chkUpgrade_errVar(): ERROR: Found an *earlier* error, such that $err==[10]

    [2013-10-29 12:06:43 +0100 updater.pl] chkUpgrade_errVar(): Halting further processing.

    [root@arcsight Desktop]#

    [root@arcsight Desktop]# "

    Do you have any suggestions?

    Thanks in advance,