Highlighted
Oliver843 Honored Contributor.
Honored Contributor.
849 views

ArcMC thinks logger is down

Jump to solution

Hello,

Our ArcMC currently believes one of our loggers is unreachable and that one of our connectors is also unreachable.

According to both loggers the connector is sending events and the logger is operational.

I have resarted the arcmcagent service on the logger but to no avail.

Could anyone give me some things to try to get these nodes to be reported as functional?

Kind Regards

Oliver

 

Tags (3)
0 Likes
1 Solution

Accepted Solutions
Oliver843 Honored Contributor.
Honored Contributor.

Re: ArcMC thinks logger is down

Jump to solution

FIxed It!!

Some odd things to cover here though. So i'll talk you through what i did and what actually worked.

The logger was being reported as down although this was not the case.

Steps i took:

Updated the credentials on the host - Nothing

Deleted node from ArcMC and re added it - Nothing

Manually SSH'd onto the logger and uninstalled the agent from /opt/arcsight/arcmcagent/uninstallerdata (noticed that the agent was actually version 2.6 in the directory) I checked the ArcMC and the agent version is listed as 2.7.1.

Stopped the agent service on the Logger

Readded the host via ArcMC

SSH'd back to the arcmcagent directory and the file name is still 2.6 but on the ArcMC it is listed as 2.7.1 (very bizarre)

Arcmc agent was 2.7.1 as downloaded from the web site and uploaded onto the ArcMC.

checked the directory on the logger and again found that the newly uploaded 2.7.1 agent file was being installed onto the logger as a 2.6 agent file.

After i had done this i rebooted the ArcMC and low and behold the logger had come back as healthy but wait there is more........

 

The first logger of the two which was showing no signs of issues was suddenly being listed as down 😞 anyway long story short to fix this new logger issue:

Mannually SSH onto the logger> uninstall the agent> stop the service on the logger> reboot your ArcMC > add the logger again> this time it asked for the credentials agan and bobs your uncle.

All working!!

Hope this saves someone else my pain

5 Replies
Micro Focus Expert
Micro Focus Expert

Re: ArcMC thinks logger is down

Jump to solution

The agent is correct version?

Have you tried updating the agents credentials?

0 Likes
Oliver843 Honored Contributor.
Honored Contributor.

Re: ArcMC thinks logger is down

Jump to solution

Hello Lar,

Thanks for the speedy reply.

Agent version is 2.7.1

Credentials have been updated with no improvement.

Regards

Oliver

0 Likes
Micro Focus Expert
Micro Focus Expert

Re: ArcMC thinks logger is down

Jump to solution

no worries.

I mean does the agent version match the arcmc version?

0 Likes
Oliver843 Honored Contributor.
Honored Contributor.

Re: ArcMC thinks logger is down

Jump to solution

yes the arcmc agent matches the version of the arcmc

 

Oliver

0 Likes
Oliver843 Honored Contributor.
Honored Contributor.

Re: ArcMC thinks logger is down

Jump to solution

FIxed It!!

Some odd things to cover here though. So i'll talk you through what i did and what actually worked.

The logger was being reported as down although this was not the case.

Steps i took:

Updated the credentials on the host - Nothing

Deleted node from ArcMC and re added it - Nothing

Manually SSH'd onto the logger and uninstalled the agent from /opt/arcsight/arcmcagent/uninstallerdata (noticed that the agent was actually version 2.6 in the directory) I checked the ArcMC and the agent version is listed as 2.7.1.

Stopped the agent service on the Logger

Readded the host via ArcMC

SSH'd back to the arcmcagent directory and the file name is still 2.6 but on the ArcMC it is listed as 2.7.1 (very bizarre)

Arcmc agent was 2.7.1 as downloaded from the web site and uploaded onto the ArcMC.

checked the directory on the logger and again found that the newly uploaded 2.7.1 agent file was being installed onto the logger as a 2.6 agent file.

After i had done this i rebooted the ArcMC and low and behold the logger had come back as healthy but wait there is more........

 

The first logger of the two which was showing no signs of issues was suddenly being listed as down 😞 anyway long story short to fix this new logger issue:

Mannually SSH onto the logger> uninstall the agent> stop the service on the logger> reboot your ArcMC > add the logger again> this time it asked for the credentials agan and bobs your uncle.

All working!!

Hope this saves someone else my pain

The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.