Highlighted
Absent Member.
Absent Member.
1048 views

ESM services wont start

Jump to solution

Hi,

After a system crash when ESM boots up we are unable to run ./arcsight_services start.

All that is displayed is the build version..

On starting individual services the message received is 'monit is busy, wait up to 1min' to no avail.

Have tried:

- killing all arcsight owned pid's.

- rebooting with the arcsight_services file disabled so no services attempt to come up.

Any Ideas!?? Really dont want to have to roll this back.

Labels (1)
0 Likes
1 Solution

Accepted Solutions
Highlighted
Established Member..
Established Member..

Re: ESM services wont start

Jump to solution

Sam -

Have you looked into the <Arcsight Home>/manager/logs/default/server.std.log or ERROR for FATAL messages?

You may need to reboot but to disable the auto start of your ESM so you can then try to bring it up one at a time for better verification of where the error may be coming from.

scotty

View solution in original post

0 Likes
7 Replies
Highlighted
Established Member..
Established Member..

Re: ESM services wont start

Jump to solution

Sam -

Have you looked into the <Arcsight Home>/manager/logs/default/server.std.log or ERROR for FATAL messages?

You may need to reboot but to disable the auto start of your ESM so you can then try to bring it up one at a time for better verification of where the error may be coming from.

scotty

View solution in original post

0 Likes
Highlighted
Absent Member.
Absent Member.

Re: ESM services wont start

Jump to solution

Hi Scott,

There are a number of ERROR/FATAL log entries all at the time of the crash:

Error - Event Receiver

Error - Database Connection

Error - User Session Server

FATAL EXCEPTION:java.io.IOException: end of communication channel

[FATAL] java.nio.channels.ClosedChannelException

So, we are currently getting no logs when we start the manager service in the /manager/logs/default/server.std.log - which seems odd.

Did the above by changing the arcsight_services script name as this is where the init scripts point to bring up the services..

Still no love when bringing up one by one.

Appreciate any other ideas..

Sam

0 Likes
Highlighted
Established Member..
Established Member..

Re: ESM services wont start

Jump to solution

Sam -

What was going on right before it crashed?  the monit process is used to make sure that you have the necessary services running; it has gotten in the way for me in situations like this as it keeps on wanting to start things you want dead.

are your storage arrays or attacked storage there and intact?  What version of the ESM are you running?

scotty

0 Likes
Highlighted
Absent Member.
Absent Member.

Re: ESM services wont start

Jump to solution

Hi Scott,

File system checks turned out ok.

Turns out the arcsight binary in /bin was corrupt.. (ie the MD5 was different to that of another instance)

So copied one across from a different instance, and up she came!

Thanks for your help..


lets hope thats it.

0 Likes
Highlighted
Established Member..
Established Member..

Re: ESM services wont start

Jump to solution

Good to hear -

Do not forget to mark your post answered as it just may help someone else solve their problem too; as well as any posts that were helpful.

Good times.

scotty

0 Likes
Highlighted
Contributor.
Contributor.

Re: ESM services wont start

Jump to solution

Hi Sam,

Can you please clarify which binary file are you referring too?

How did you identify the change in MD5 hash.

0 Likes
Highlighted
Established Member..
Established Member..

Re: ESM services wont start

Jump to solution

Rajveer -

you can use the command md5sum and the name of the file you want it to sizeup

scotty

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.