UPDATE! The community will be go into read-only on April 19, 8am Pacific in preparation for migration on April 21. Read more.
UPDATE! The community will be go into read-only on April 19, 8am Pacific in preparation for migration on April 21.Read more.
Absent Member.
Absent Member.
574 views

ESM Upgrade 4.5 SP2 to 5.0

I'm planing to upgarde my installation to 5.0 from 4.5 SP2.

So I would like to ask the community for some experience, fieldreports etc... this could be interesting since the release of 5.0 also for a few other people who are trying to update.

Thanks in advance

Labels (1)
0 Likes
4 Replies
Absent Member.
Absent Member.

I would peruse this thread as you might get some answers here. I have revised and ultimately deleted everything else I was going to say and will just end with I won't upgrade major versions again until the first service pack hits.

0 Likes
Absent Member.
Absent Member.

"I won't upgrade major versions again until the first service pack hits."

The above statement has been a painful lesson to learn.  After managing two ESMs for a couple years now, I have come to the exact same conclusion.

0 Likes
Absent Member.. Absent Member..
Absent Member..

We are finishing our production upgrades today. We went from 4.5 Sp2 to 5.0 Sp1. We skipped 5.0 patch1 as it was contained with sp1.

Lets see, post upgrade issues we have noticed:

1) making modifications to user accounts causes the tree in the navigator to collapse after every change. (Bug ESM-47143)

     ArcSight offered a workaround, but the workaround reduces console performance......

     resourcetree.node.child.load.asynchronous=false

2) 5.0 introduced changes to report templates that cause them to appear in a single color. 5.0 Sp1 fixes the default ArcSight templates, but all you custom report templates remain broken.....    I posted the fix in another thread.  (bug ESM-46981)

3) 5.0 breaks the 'Logger Quick Search" Integration Command (bug ESM-47107)

4) Scheduled reports set to UTC have their time zone reset to somethign else (bug ESM-47137). It looks like they read the name of the time zone from an array and the number of elements in the array changed (most likley with the JRE update).

5) Not all case activity is recoreded in the audit trail (in the notes) after 5.0 (bug ESM-46568)

6) We have been badly hit by the tree collapse issue in the navigator when using cases as well, the workaround does not work there. and the issue may be a bit different, we are still working that one with support.

7) Query Viewers display date fields as Epoch time not a date format (bug ESM-46331)

😎 We have noticed an issue with Custom Layout dashboards (image viewer), it appears something is broken in the components that handle the authentication of web services. After 5.0 you will notice that when you log in via console there are actually 2 logins (console and service). For us the service logins are failing and I think this is why we cannot get image viewer to work. Note that 5.0 now needs port 9090 in addition to port 8443. Support has not responded to my discoveries around the wewb services auth yet so no direction on this one yet.

This has been our experince so far........

HTH

Dean

0 Likes
Absent Member.. Absent Member..
Absent Member..

couple of updates

#1, the entry they gave us for console.properties causes performance impact. They offered an additional value to offset the impact somewhat:

     resourcetree.node.child.load.asynchronous=false
     resourcetree.node.child.load.asynchronous.timeout=5000

#8 Confirmed to be related to password complexity being enabled, critcal bug ESM-47228 filed for this issue. Awaiting an ETA to fix.

Another bug we have been seeing is the logging of this error:

[2011-03-16 15:55:00,995][WARN ][default.com.arcsight.common.schedule.Scheduler$TimerThread][mainLoop] Scheduled execution skipped because previous execution has not ended (Resource Search Index Updater)

It can appear in the logs related to any of the updater functions. ArcSight ahs idenified the buggy code and has fixed it. Awaiting word what patch or update the fix will be included in. The word from support is that the jobs are running but they are getting overscheduled causing the errors.

HTH

Dean

Message was edited by: farridem

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.