Having problems with your account or logging in?
A lot of changes are happening in the community right now. Some may affect you. READ MORE HERE
Highlighted
Infosec Super Contributor.
Super Contributor.
300 views

A way to re-initiate failed events backup

Jump to solution

Hi, 

Does anyone know if there is any way to re-initiate failed daily events backup in ArcSight Logger? After long absense I have noticed that a number of daily backups failed and I need to recreate them, however I cannot find any way in the UI to do this automatically. 

0 Likes
1 Solution

Accepted Solutions
Infosec Super Contributor.
Super Contributor.

Re: A way to re-initiate failed events backup

Jump to solution

So our support team told us a simple solution.

Delete the failed archives. 

Recreate archive for the specified period. If this period spans several days, it will automatically split them into daily chunks. 

0 Likes
2 Replies
Frequent Contributor.. Jesper_Bassoe Frequent Contributor..
Frequent Contributor..

Re: A way to re-initiate failed events backup

Jump to solution

I would raise a support ticket.

I had the same problem a week ago on the ESM and got this from support - Perhaps something similar for Logger exists

1. Login to Command Center and Access Administration > Storage and Archive
2. Get the ID of the archive job inside the retention period of the storage group that was deleted by mistake.
3. Login to postgresql by running the command /opt/arcsight/logger/current/arcsight/bin/psql -U web -d rwdb
4. Run the command select * from alg_eventarchive_ng where id = '<ARCHIVEID>'; to confirm the archive job exists
5. Run the command delete from alg_eventarchive_ng where id ='<ARCHIVEID>; to delete the archive job
6. Run the command \q to exit postgresql
7. Run the command to stop ESM services /etc/init.d/arcsight_services stop
8. Run the command to start ESM services again /etc/init.d/arcsight_services start
9. Once services are started login to the Command Center and Go to Administration > Storage and Archive and confirm the archive is available again with status not schedule
10. Select the archive and click on the button archive now so the archive is done

0 Likes
Infosec Super Contributor.
Super Contributor.

Re: A way to re-initiate failed events backup

Jump to solution

So our support team told us a simple solution.

Delete the failed archives. 

Recreate archive for the specified period. If this period spans several days, it will automatically split them into daily chunks. 

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.