Archive report generation failed:

[stephon.primous]

  Upgraded to 5.0 on the ESM: Now I am getting the below error on a few of my reports any thought on a fix?   Reason: inetsoft.sree.RepletException: Failed to create report: com.arcsight.server.reports.ReportGenerationException: Encountered error while fetching data: ORA-01555: snapshot too old: rollback segment number 33 with name "_SYSSMU33$" too small

[GCA]

I'm struggling with the same issue but I'm still on 4.5 .  While this is not really a fix, I noticed that it's better to use .xls instead of .csv and to split your failing reports in smaller time slices. I have opened a ticket with the support and suggest you to do the same.

[chrisb1]

Have you checked the size of your ARC_UNDO table?  That's generally one of the causes.  IIRC, it should be approx 1GB for every 1 million EPD you get (80 million EPD = 80GB table size).  Also, try to key off of indexed fields, it seems to help.  Unfortunately the error isn't specific to 5.0, you may have just been getting lucky.

I personally have created custom indicies that I key off of and force Oracle to use them via hints, and it works like a charm (but isn't supported )

[Vini]

This is one of the most common oracle errors apparently, many databases are plagued with these errors. If I still remember correctly, this happens because the state of the table needs to be maintained until the query finishes, so oracle maintains a snapshot of the state of the table for the query to run and depending on the amount of data you have going to that table you are going to need more or less undo space. Don't hesitate to correct me if I am wrong.

As Chris suggested increasing the ARC_UNDO table space may resolve the issue but depending on the retention and the volume of UNDO that you system does it may not be enough. My UNDO is 170GB and it is only enough because I have allowed oracle to dynamically manage the UNDO retention so that I don't easily run out of UNDO space.

Note that changing the UNDO retention policy is not a supported by ArcSight although there is no negative impact.

[zakwan1]

Hi Vini,

Can you provide me the command or how to increase the ARC_UNDO table space?Currently I'm facing this issue.

Thanks

Regards,

Zakwan Yusoff

[anwarrhce1]

Hi Zakwan,

Login to database server and navigate to database bin directory ARCSIGHT_HOME/bin and execute ./arcsight database xts

This will pop up a window and there you can increase the size of any of your table space.

Regards,

Anwar

[Vini]

The method suggested by Anwar is probably the easier one.

I always do this manually in the oracle db.

Let us know if it does not work for you and we can help you further.

[zakwan1]

Hi Vini,

After increasing the ARC_UNDO table space to triple,I still facing this issue.I also already patch my oracle database.Beside that,I also already upgraded my ESM and DB from version 5.0 SP1 to 5.0 SP1 patch 3 which is the latest one for SP1

[Vini]

Can you tell me:

How many EPS do you get on average?

How many events per day total?

What are you trying to retrieve using this query?

What is the total size of the undo table space?

Are you 100% sure the error is ORA-01555?