Highlighted
Micro Focus Frequent Contributor
Micro Focus Frequent Contributor
2204 views

FIX for - Reduced EPS of ArcSight Smart Connector 7.8.0.8070.0 sending events to Logger

 

From our analysis we have found that the reduced EPS from Connector 7.8.0 to Logger has been caused by a Java upgrade. We are working on updating the release notes with the steps to fix the issue. Please contact support if you need an immediate fix.(See below for "Update:") Fix involves turning off a JDK property.

The workarounds of updating the persistence and/or multithreading properties described in the following threads are not required.

https://community.softwaregrp.com/t5/ArcSight-Discussions/Reduced-EPS-performance-of-ArcSight-Smart-Connector-7-8-0-8070-0/m-p/1646238

https://community.softwaregrp.com/t5/ArcSight-Discussions/Connector-Framework-7-8-0-8070-0-issue/m-p/1645233

 

Update: Release notes has been updated with steps for fix. Please contact support if you need assistance.

 

Thank you,

ArcSight Product Team

 

6 Replies
Highlighted
Knowledge Partner Knowledge Partner
Knowledge Partner

The "official" fix is actually causing even more work (and probably a reduction in security) then the persistence value though...

Hopeflly there is a 7.9 release very soon or an updated 7.8 build with a new java version. In my opinion MicroFocus should take down the current 7.8 version.

0 Likes
Highlighted
Honored Contributor.
Honored Contributor.

Don't expect such thing. The parser update is already out based on the time schedule which looks that it's kind important some some people than to have a functional without magic framework version.

Comparing with 7.6 (if I remember correctly) framework issue with Azure then response this time is slow and not enough.

0 Likes
Highlighted
Frequent Contributor.
Frequent Contributor.

Hello,

Fix involves turning off a JDK property.

Ok, can you please share the step to fix it ? Instead of creating again an another ticket to support ?

Thank you.

 

0 Likes
Highlighted
Micro Focus Frequent Contributor
Micro Focus Frequent Contributor

Release notes has been updated with steps for fix. Please contact support if you need assistance.

Highlighted
Respected Contributor.. Respected Contributor..
Respected Contributor..

Hi, we are experencing the same issue with SmartConnector 7.9.0, having the need to add the parameter transport.loggersecure.connection.persistent=true to not have EPS reduced. Is the fix in agent.wrapper.conf (metioned in SmartConnector 7.8.0 release notes) necessary?

0 Likes
Highlighted
Outstanding Contributor.
Outstanding Contributor.

Hello Victor,

If you are still facing the issue after upgrade to 7.9, then it maybe that some parameters are still in the argent.properties from earlier troubleshooting.

Check the agent.properties of any connector sending to this logger for the following lines (which would have been added manually):

transport.loggersecure.connection.persistent=true

transport.loggersecurepool.connection.persistent=true

Delete or comment them out and restart the connector. Prior to 7.8, in some cases we were adving that these lines be added to the agent.properties

If you have upgraded or installed connector 7.9, it should already contain the correct line for the agent.wrapper.conf, however it is worth confirming that it is there.

The symptoms of this issue is that the incoming EPS will drop after some time (depending on the amount of incoming EPS, it may be less noticable in some environments then others). If after a restart of just the apache process on the logger, the EPS is back to correct EPS rate, and then after some time it drops off again, it is likely that you are facing this issue.

Hope it helps.

Lar

The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.