ESM Scheduled Job not running
I have a weekly report that is scheduled to run every Friday at 1000.
I can run it manually without issue, using the default parameters and it will email to the address in the defaults.
However, when the scheduled job is supposed to run, I get no email. The job shows up in the Scheduled Jobs page and shows the most recent (this morning's) has run Successfully. It also shows next week's as Pending and the jobs before it as Successful.
Is there a log that might show any errors that may be causing this job to not actually run?
Try running an Active Channel with the following filter. This filter will retrieve all ArcSight audit events related to reports.
deviceEventClassId CONTAINS "report"
look into the server.log* at the time when the schedule suppose to run and try to understand what it is happening with the scheduled task.
Base on the version of ESM those logs can be found in :
/opt/arcsight/var/logs/manager/default - starting with ESM 7.x to newer version.
/opt/arcsight/manager/logs/default - from ESM 6.11 to older version of ESM.
Thanks for the replies!
I am able to see the report:100 and report:104 events for the start and end of the report generation. I can also see the entries in the server.log file showing the scheduled job starting and completing.
However, I do not see anything in the server.log that would indicate why this report would not email as part of the scheduled job, nor any reference to the report emailing successfully on subsequent reports.
Any suggestions are greatly appreciated.
so the issue is not with the reports itself is due to the fact that you cannot send the e-mail that contain the report.
What version of ESM you have?
Did you test to see if you can really send e-mails from ESM ?