Having problems with your account or logging in?
A lot of changes are happening in the community right now. Some may affect you. READ MORE HERE
rayrp1 Valued Contributor.
Valued Contributor.
1020 views

Arcsight Connector Issues

I am running ArcSight-7.2.4.7831.0-Connector, I know it is a old version but it seems to be the only one that works on our servers. I am running into an issue though on one of our servers where after the connector is setup it will kill the service at random. the only information i see is that it stoped due to a fileissue, table issue, configuration issue and so on. basically it dosent know why it stopped. Has anyone ran into this issue before? if so please let me know how to fix. 

0 Likes
5 Replies
David Bau Outstanding Contributor.
Outstanding Contributor.

Re: Arcsight Connector Issues

 

Hi

Which connector type and on which OS?

0 Likes
rayrp1 Valued Contributor.
Valued Contributor.

Re: Arcsight Connector Issues

The configuration is from Windows Event logs Native, and it is sitting on a virtual Windows 2012 R2 Server. 

0 Likes
rayrp1 Valued Contributor.
Valued Contributor.

Re: Arcsight Connector Issues

On top of this im am noticing that after a certain amount of connectors intstalled in the same server, they start catching...could this be due to a lack of hardware resources??

0 Likes
Highlighted
Marijo Mandic Acclaimed Contributor.
Acclaimed Contributor.

Re: Arcsight Connector Issues

Hello,

1) You are using SmartConnector framework version 7.2.4 which was released July 1, 2016 and currently we are at framework version 7.7.0.8044.0 which was released December 11, 2017.
2) There have been some BUG fixes regarding WiNC in between versions so I would suggest that you try with latest framework (please do fresh install, not upgrade).
3) Additionally, if SmartConnector caches this usually tells us that there is an issue with Destination. This would translate for example you have 1000 EPS on SmartConnector but ESM for example can persist only 500 EPS and therefore 500 EPS goes to Cache (for example due to ESM performance issue, overloaded etc..).

Regards,

Marijo

rayrp1 Valued Contributor.
Valued Contributor.

Re: Arcsight Connector Issues

Thank you for your help, we will try to get the newest framework. As for the caching, I dont think its the destination. my reasoning for this is because the exact same amount of endpoint were forwarding logs to connectors installed on a Linux server that used the Unified configuration, then forwared to the Arcsight logger with no caching issue. I have noticed that when I  install several connectors  the CPU on the server they reside on is fairly low; then I get to a certain point lets say the 6th connector and then CPU usage for this connector (just starting the wizard) spikes to 40% or more. I cannot understand why it does this other than the framework having bugs as you said and having difficulties reading the program correctly at some point.  

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.