ESM Upgrade 4.5 SP2 to 5.0
I'm planing to upgarde my installation to 5.0 from 4.5 SP2.
So I would like to ask the community for some experience, fieldreports etc... this could be interesting since the release of 5.0 also for a few other people who are trying to update.
Thanks in advance
I would peruse this thread as you might get some answers here. I have revised and ultimately deleted everything else I was going to say and will just end with I won't upgrade major versions again until the first service pack hits.
"I won't upgrade major versions again until the first service pack hits."
The above statement has been a painful lesson to learn. After managing two ESMs for a couple years now, I have come to the exact same conclusion.
We are finishing our production upgrades today. We went from 4.5 Sp2 to 5.0 Sp1. We skipped 5.0 patch1 as it was contained with sp1.
Lets see, post upgrade issues we have noticed:
1) making modifications to user accounts causes the tree in the navigator to collapse after every change. (Bug ESM-47143)
ArcSight offered a workaround, but the workaround reduces console performance......
2) 5.0 introduced changes to report templates that cause them to appear in a single color. 5.0 Sp1 fixes the default ArcSight templates, but all you custom report templates remain broken..... I posted the fix in another thread. (bug ESM-46981)
3) 5.0 breaks the 'Logger Quick Search" Integration Command (bug ESM-47107)
4) Scheduled reports set to UTC have their time zone reset to somethign else (bug ESM-47137). It looks like they read the name of the time zone from an array and the number of elements in the array changed (most likley with the JRE update).
5) Not all case activity is recoreded in the audit trail (in the notes) after 5.0 (bug ESM-46568)
6) We have been badly hit by the tree collapse issue in the navigator when using cases as well, the workaround does not work there. and the issue may be a bit different, we are still working that one with support.
7) Query Viewers display date fields as Epoch time not a date format (bug ESM-46331)
😎 We have noticed an issue with Custom Layout dashboards (image viewer), it appears something is broken in the components that handle the authentication of web services. After 5.0 you will notice that when you log in via console there are actually 2 logins (console and service). For us the service logins are failing and I think this is why we cannot get image viewer to work. Note that 5.0 now needs port 9090 in addition to port 8443. Support has not responded to my discoveries around the wewb services auth yet so no direction on this one yet.
This has been our experince so far........
couple of updates
#1, the entry they gave us for console.properties causes performance impact. They offered an additional value to offset the impact somewhat:
#8 Confirmed to be related to password complexity being enabled, critcal bug ESM-47228 filed for this issue. Awaiting an ETA to fix.
Another bug we have been seeing is the logging of this error:
[2011-03-16 15:55:00,995][WARN ][default.com.arcsight.common.schedule.Scheduler$TimerThread][mainLoop] Scheduled execution skipped because previous execution has not ended (Resource Search Index Updater)
It can appear in the logs related to any of the updater functions. ArcSight ahs idenified the buggy code and has fixed it. Awaiting word what patch or update the fix will be included in. The word from support is that the jobs are running but they are getting overscheduled causing the errors.
Message was edited by: farridem