Big news! The community will be moving to a new platform April 21. Read more.
Big news! The community will be moving to a new platform April 21. Read more.
Absent Member.
Absent Member.
495 views

ERROR: Unable to delete file : MS SQL Server

Hi All,

We have a MSSQL server in our environment. Logs are getting saved locally on that server itself. We are taking logs remotely.

We were getting logs peacefully before, but now no logs are coming to ESM.

Checked the shared folder, logs are there for last 2 days but its not getting forwarded. Moreover suddenly new .trc files has stopped getting generated, so no new .trc files now.

Please check the error which I am getting in both agent and agent.out.wrapper logs.

FATAL EXCEPTION:

Unable to delete file [D:\ArcSight\SmartConnectors\sql\current\user\agent\agentdata\ps.966833EFCBB88EFECF1D8D306C489A04D2754097.36su61y4BABDaY7VT8Beieg==.0]

this error is triggering very frequently.

Please suggest. Thanks in advance.

Regards,
Ravi



Labels (2)
0 Likes
8 Replies
Absent Member.
Absent Member.

Another error which I am seeing is "<Remote filelocation> does not does not exist. I have tried both UNC & MAP path also, but getting the same error.


Any help would be greatly appreciated

0 Likes
Fleet Admiral
Fleet Admiral

Hi Ravi,

Is your Connector is reading the log files from local server. Is the connector server service uses the local machine credentials to access logs ? Are you observing the Connector Caching or Dropping events message from the connector. Have you checked the Connection from the Connector machine to the ESM ?

0 Likes
Absent Member.
Absent Member.

 

  1. Is your Connector is reading the log files from local server.

    No its not reading instead it is showing "<Remote filelocation> does not does not exist.

  2. Is the connector server service uses the local machine credentials to access logs?

    Yes

  3. Are you observing the Connector Caching or Dropping events message from the connector. Have you checked the Connection from the Connector machine to the ESM?

    No

  

0 Likes
Absent Member.
Absent Member.

  1. Is your Connector is reading the log files from local server.No its not reading instead it is showing "<Remote filelocation> does not does not exist.
  2. Is the connector server service uses the local machine credentials to access logs?Yes
  3. Are you observing the Connector Caching or Dropping events message from the connector.

No

  1. Have you checked the Connection from the Connector machine to the ESM?

Yes, its proper, we have other connectors as well on that server.

0 Likes
Fleet Admiral
Fleet Admiral

Does that file actually exist?

I'm assuming that you have the SmartConnector running locally on the DB Server. Can you confirm that is the case? If you restart the smartconnector, does the problem recur?

0 Likes
Fleet Admiral
Fleet Admiral

Hi Ravi,

Logs are getting saved locally on that server itself. We are taking logs remotely.

You have mentioned it is as remote path. Is the connector reading the logs once it is moved to the shared path ? Try to edit the agent setup and set the log directory again and see whether the connector reads the log file ?

Have you tried running the connector in standalone mode instead of service restart.

0 Likes
Absent Member.
Absent Member.

Yes the folder location exists.

Connector is not installed locally on the DB server. I have installed it in one of our agent server. I am able to access that remote file location (folder name Sqltrace) directly from the agent server. I have restarted the connector also many time but still error persists.

I have mapped the remote file location to agent server(Locally) but still getting the same error.

0 Likes
Fleet Admiral
Fleet Admiral

Hi Ravi,

OK, I'm still a bit hazy on the exactly what the setup looks like, but I think I understand a bit further.

You mentioned that the folder exists, but I should reclarify the question:

Does the file "D:\ArcSight\SmartConnectors\sql\current\user\agent\agentdata\ps.966833EFCBB88EFECF1D8D306C489A04D2754097.36su61y4BABDaY7VT8Beieg==.0]" still exist (because the connector is trying to delete it), and to doublecheck why the user that the smartconnector is running as does not have permissions to delete files in that folder.

The connector needs to be able to create/modify/delete all files within its install path, and in particular within the \agentdata\ folder to function properly. I think that the ps.* files are pointer files where the connector keeps track of where it last read from in 'stateful' type connectors such as MSSQL.

Perhaps some other program has locked that file? I find the Windows SysInternal tool Process Explorer is the best for that job.

Hope that helps,

RK

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.