folender Super Contributor.
Super Contributor.
473 views

[ERROR][DirectConnection$ReadChannel] in "logger_web.log" and "logger_server.log"

Hello!
I'm seeing the following ERROR in the logfile "/opt/arcsight/logger/userdata/logger/logs/logger_web.log" exactly every half hour:

[2017-08-05 18:30:15,512][INFO ][TcpServerService][TcpServerService: 127.0.0.1:7780] Got connections at port: 127.0.0.1:7780
[2017-08-05 18:30:15,513][INFO ][TcpServerService][TcpServerService: 127.0.0.1:7780] Waiting for connections at port: 127.0.0.1:7780
[2017-08-05 18:30:15,514][ERROR][DirectConnection$ReadChannel][pool-2-thread-62]
!! DirectConnection ReadChannel thread 157 has died.  reason=end of communication channel

[2017-08-05 18:30:15,534][INFO ][TcpServerService][TcpServerService: 127.0.0.1:7780] Got connections at port: 127.0.0.1:7780
[2017-08-05 18:30:15,535][INFO ][TcpServerService][TcpServerService: 127.0.0.1:7780] Waiting for connections at port: 127.0.0.1:7780
[2017-08-05 18:30:15,974][ERROR][DirectConnection$ReadChannel][pool-2-thread-62]
!! DirectConnection ReadChannel thread 157 has died. reason=end of communication channel


The numbers in red increase by one every half an hour.
The same error appears in "logger_server.log".

Any idea what could be causing this errors?

Manager details: ESM 6.9.1 Patch1 in a VM (Red Hat Enterprise Linux Server release 6.7) with 32 CPUs, 125 GBs. RAM (49 GBs. Manager Heap Size) and plenty free space in every partition.

Regards,
Fabian

Labels (2)
0 Likes
3 Replies
folender Super Contributor.
Super Contributor.

Re: [ERROR][DirectConnection$ReadChannel] in "logger_web....

Hello!
Can someone point me in some direction to dig a little more please?
Im really lost here, no idea what these error means!

Regards,
Fabian

0 Likes
folender Super Contributor.
Super Contributor.

Re: [ERROR][DirectConnection$ReadChannel] in "logger_web....

Hi, an update on this:
It happens every time i run the following command:

/etc/init.d/arcsight_services status logger_web

It was happening exactly every half an hour because i have a Script in the ESM runing that command for all services.
However, the question remains... Why is it throwing an ERROR?

Regards,
Fabian

0 Likes
Highlighted
Aleks Super Contributor.
Super Contributor.

Re: [ERROR][DirectConnection$ReadChannel] in "logger_web....

Hello Fabian,

This error tells that communication channel has ended. This is not critical but rather informative.

When you run command to get service status, the script opens the connection to 127.0.0.1 on port 7780, get the answer from service about its status and close connection. Actually, when the connection is closed ERROR message is generated. Why it is not INFO but ERROR, I think is the question to developers.

By the way, there is great service for analyzing ArcSight logs ucl.socprime.com/hc/health-check/. Soc Prime also has the solution for real-time monitoring of diagnostic logs of ESM, Logger and Connectors.

Kind regards,

Aleks

 

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.