Our vBulletin migration is complete.
Welcome vBulletin users! All content and user information from the Micro Focus Forums (vBulletin) site has been migrated to this site. READ MORE.

ArcSight Event Broker 2.21 from the ground up build guide - v1d

ArcSight Event Broker 2.21 from the ground up build guide - v1d

This guide shows how to install Event Broker in a lab environment. This guide was created by the ArcSight PreSales Technical Enablement team as a resource for the ArcSight PreSales organization. This guide is not official documentation. Please read and refer to the official product documentation for additional information. Please see the ArcSight Investigate 2.20 from the ground up build guide for instructions on installing the ArcSight Investigate.

Our deployment uses 6 nodes (3 x Master nodes; 3 x Worker nodes) and an external NFS server. The guide covers: setting up SmartConnectors as Producers; setting up Logger and ESM as Consumers; setting up ArcMC for Event Broker management.

Architecture (6 Nodes)

  • Masters on 3 nodes; Workers on 3 nodes
  • This deployment uses an external NFS server





  • Updated the Adding a license to Event Broker section.


  • Renamed to v1c, no changes to the guide.


  • Removed the Shutting down the Event Broker Virtual Machines section as this is handled with /usr/lib/systemd/system/kubelet.service.


Labels (1)


Some content on Community Tips & Information pages is not officially supported by Micro Focus. Please refer to our Terms of Use for more detail.
Re: ArcSight Event Broker 2.21 - DNS and host setup and configuration - v1a

Here are errors I've seen with Event Broker 2.21 (Installer 1.50.9) when an internal or external dns server is setup that cannot forward/reverse lookup based on hostname/fqdn/ip. For every node in the cluster, please check /etc/resolv.conf and make sure you can forward/reverse lookup for every server listed. Use the syntax of "nslookup [name] [server]" to check every entry in /etc/resolv.conf. For example, "nslookup eb1.example.com" is used to query the DNS server for the entry eb1.example.com.

[FATAL] 2018-08-06 09:21:53 : Failed to get X-AUTH-TOKEN. Please make sure the inputted password is correct.

First deploy phase failed!

Error while deploying core services. Please see logs for more details. Installation will be aborted! 

[FATAL] 2018-06-21 08:39:49 : Failed to store key [/suite-installer/v1.1/ca-external-host] value [investigate.arcsight.example.com]

First deploy phase failed!

Error while deploying core services. Please see logs for more details. Installation will be aborted!


E0619 16:20:58.857550       1 reflector.go:205] k8s.io/kubernetes/vendor/k8s.io/client-go/informers/factory.go:73: Failed to list *v1.PersistentVolume: Get https://investigate.arcsight.example.com:8443/api/v1/persistentvolumes?resourceVersion=0: dial tcp getsockopt: connection refused


E0619 16:20:58.618701       1 leaderelection.go:224] error retrieving resource lock kube-system/kube-controller-manager: Get https://investigate.arcsight.example.com:8443/api/v1/namespaces/kube-system/endpoints/kube-controller-manager: dial tcp getsockopt: connection refused


E0619 09:20:09.319687    7784 eviction_manager.go:238] eviction manager: unexpected err: failed to get node info: node 'investigate.arcsight.example.com' not found

Some comments from someone in Micro Focus Professional Services:

  1. Event Broker requires a domain including a TLD assigned to it. Example: Installing EB with the default system domain assignment “local” will fail during the installation setup.
  2. Correct system time between the different EB nodes as time synchronization is critical.
  3. EB requires EXT4 as a file system to run on. Default CentOS image install will assign XFS, it is easy to forget this which will result in the need to re-image the system before installing EB.


If you are using a proxy server, you will need to configure proxy exceptions for all of the following:


  • All node IP’s
  • All node FQDN’s
  • Virtual IP & FQDN (Multi Master)
  • localhost




Top Contributors
Version history
Revision #:
3 of 3
Last update:
‎2018-11-01 17:02
Updated by:
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.