Super Contributor.. hatemware Super Contributor..
Super Contributor..
484 views

Failed to trigger script execution from correlation rule

Jump to solution

Hi All,

I have configured a simple bash script that write a username in a correlation event which is passed as an argument to the script when the correlation rule is triggered.

My problem is: When I execute the comand ./<scrip.sh> by CLI, the script runs properply. But when the rule is triggered in the ESM it doesn't run the script.

I am using esm 6.11 and below is the user and group permissions assigned to the script:

[arcsight@esm611 ~]$ ls -ltr writeUser.sh
-rwxrwxrwx. 1 arcsight arcsight 219 Nov 26 15:08 writeUser.sh

The script is very simple
==============
#!/bin/bash
export LD_LIBRARY_PATH=/opt/arcsight/manager/jre/lib/amd64/server:/opt/arcsight/manager/jre/lib/amd64:/opt/arcsight/manager/jre/../lib/amd64:/lib64/:
echo "First arg: $1" >> users.txt
echo "Second arg: $2" >> users.txt
==============

I added the below line as per posts (https://community.softwaregrp.com/t5/ArcSight-Discussions/Problems-ArcSight-notification-script-and-quot-execute-command/td-p/1596420) and (https://community.softwaregrp.com/t5/ArcSight-Discussions/Fail-to-execute-command-for-SSH/td-p/1580781)
==============
export LD_LIBRARY_PATH=/opt/arcsight/manager/jre/lib/amd64/server:/opt/arcsight/manager/jre/lib/amd64:/opt/arcsight/manager/jre/../lib/amd64:/lib64/:
==============

I have tried to pass the arguments and execute the .sh in ESM with:


Platfrom: Linux
Command: /bin/bash /home/arcsight/scripts/writeUser.sh
Argument: "$name" "$targetUserName"

Platfrom: Linux
Command: /bin/bash
Argument: /home/arcsight/scripts/writeUser.sh "$name" "$targetUserName"

Platfrom: Linux
Command: /home/arcsight/scripts/writeUser.sh
Argument: "$name" "$targetUserName"

Any idea how to solve this?

BR,
hatem

0 Likes
1 Solution

Accepted Solutions
Super Contributor.. hatemware Super Contributor..
Super Contributor..

Re: Failed to trigger script execution from correlation rule

Jump to solution

Hi Folks,
The issue is resolved after following the KB: Document ID : KM00233702 @ https://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/-/facetsearch/document/KM00233702

BR,
Hatem

0 Likes
2 Replies
Highlighted
Super Contributor.. hatemware Super Contributor..
Super Contributor..

Re: Failed to trigger script execution from correlation rule

Jump to solution

Hi Folks,

Any ideas?

BR, Hatem

0 Likes
Super Contributor.. hatemware Super Contributor..
Super Contributor..

Re: Failed to trigger script execution from correlation rule

Jump to solution

Hi Folks,
The issue is resolved after following the KB: Document ID : KM00233702 @ https://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/-/facetsearch/document/KM00233702

BR,
Hatem

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.