Commodore Commodore
Commodore
697 views

ESM Emailed Report Notifications Stops

We have never gotten the root cause yet. We usually have to reboot ESM and or ArcMC to deal with it.  All our reports are set to run from schedule and email receipients. We would go for months without issue but suddently the email part would not work. The reports run and get archived but the emails never go out.

Any suggestion for resolution?

 

Thanks

Vignesh

0 Likes
5 Replies
Micro Focus Frequent Contributor
Micro Focus Frequent Contributor

Hello

Is it possible for you to open a service request case directly to Arcsight? we need more details in order to understand your network environment. That would be easier for us and  maybe  a webex session and some logs.

regards

Maritza

0 Likes
Commodore Commodore
Commodore

Can you email the web link to the new software support portal for MicroFocus?

I only have the link to the HPE portal.

Thanks

Vignesh

0 Likes
Micro Focus Frequent Contributor
Micro Focus Frequent Contributor

Hi Vignesh

Try this

https://softwaresupport.hpe.com/group/softwaresupport/case-manager

 

(Please provide details: ESM version? RHEL version? SMTP internal or external? did it work before? send error message )

 

I hope it helps

Maritza

0 Likes
Commander Commander
Commander

ArcSight has some built in SPAM controls related to notifications.  Once a notification limit is reached it will stop sending out notifications/emails.   This might be your problem depending on the volume.

These are the default values found in the /opt/arcsight/manager/config/server.defaults.properties file

notification.aggregation.max_notifications=100
notification.aggregation.time_window=1d

you  might want add new values to the  server.properties file which will override the default values.  Here is an example.

server.properties:notification.aggregation.max_notifications=500

notification.aggregation.time_window=1h

 

 

 

0 Likes
Micro Focus Expert
Micro Focus Expert

Hi Vignesh,

A little additional information that builds on the previous responses.

If indeed your notifications are being quenched because too many emails are being sent to a single destination per day, then you will see a message like this in the server log:

[2015-12-14 17:07:01,135][INFO ][default.com.arcsight.notification.d] Security team has 101 notifications

[2015-12-14 17:07:01,135][WARN ][default.com.arcsight.notification.PendingAlert] Security team is overflowing! Discarding notification

This example is for the destination "Security team".   A restart of the manager will clear this. As mentioned by a previous contributor, it is possible to adjust the properties that affect this behaviour as per document https://softwaresupport.hpe.com/group/softwaresupport/search-result/-/facetsearch/document/KM1270032.

 

Another possible issue is if you are using the bundled internal mail server provided with ESM (referred to as the "builtin").  There is a potential issue with the builtin where sometimes it can stop forwarding emails for an unknown reason. Again a manager restart will reset it.

 

If you are using the builtin then the following will be set to true in /opt/arcsight/manager/config/server.properties (or maybe server.defaults.properties if someone edited it there):

 

email.use.builtin.mailserver=true

 

If you are using the builtin server and continue to see the issue, then you could consider sending directly to an available external email server or if one is not available, to consider setting up an email relay on another server (using for example Postfix).   You might want to investigate the issue through a support case before taking this route since there is some email debug which could shed some light on anything else that might be affecting mail delivery.

 

I hope that this helps Vignesh,

 

Best regards,

Darren

 

 

 

 

 

ArcSight Support
If you find that this or any post resolves your issue, please be sure to mark it as an accepted solution.
0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.