FIX for - Reduced EPS of ArcSight Smart Connector 22.214.171.12470.0 sending events to Logger
From our analysis we have found that the reduced EPS from Connector 7.8.0 to Logger has been caused by a Java upgrade.
We are working on updating the release notes with the steps to fix the issue. Please contact support if you need an immediate fix.(See below for "Update:") Fix involves turning off a JDK property.
The workarounds of updating the persistence and/or multithreading properties described in the following threads are not required.
Update: Release notes has been updated with steps for fix. Please contact support if you need assistance.
ArcSight Product Team
The "official" fix is actually causing even more work (and probably a reduction in security) then the persistence value though...
Hopeflly there is a 7.9 release very soon or an updated 7.8 build with a new java version. In my opinion MicroFocus should take down the current 7.8 version.
Don't expect such thing. The parser update is already out based on the time schedule which looks that it's kind important some some people than to have a functional without magic framework version.
Comparing with 7.6 (if I remember correctly) framework issue with Azure then response this time is slow and not enough.
Fix involves turning off a JDK property.
Ok, can you please share the step to fix it ? Instead of creating again an another ticket to support ?
Hi, we are experencing the same issue with SmartConnector 7.9.0, having the need to add the parameter transport.loggersecure.connection.persistent=true to not have EPS reduced. Is the fix in agent.wrapper.conf (metioned in SmartConnector 7.8.0 release notes) necessary?
If you are still facing the issue after upgrade to 7.9, then it maybe that some parameters are still in the argent.properties from earlier troubleshooting.
Check the agent.properties of any connector sending to this logger for the following lines (which would have been added manually):
Delete or comment them out and restart the connector. Prior to 7.8, in some cases we were adving that these lines be added to the agent.properties
If you have upgraded or installed connector 7.9, it should already contain the correct line for the agent.wrapper.conf, however it is worth confirming that it is there.
The symptoms of this issue is that the incoming EPS will drop after some time (depending on the amount of incoming EPS, it may be less noticable in some environments then others). If after a restart of just the apache process on the logger, the EPS is back to correct EPS rate, and then after some time it drops off again, it is likely that you are facing this issue.
Hope it helps.