Fatal Execption: Another Instance of arcsight smartagents is already running
I need some help with an error in the arcsight smartconnector. I installed a smartconnector to collect logs from Sophos Anti-Virus DB but when I run the the service the connector in the console remains "down" . Checking the logs in the agent.out.wrapper I found the following error:
Another instance of ArcSight SmartAgents is already running with base folder: C:/Program Files/ArcsightSmartconnectors/sophos/current. If this is incorrect, please delete the file: C:/Program Files/ArcsightSmartconnectors/sophos/current/run/agent.lock
I deleted the mentioned file but still not working, it was the first time that I installed the connector. I killed the process manually but nothing.
Thanks for the help
It sounds like you have two services installed using the same service name. By default, when you install a SmartConnector, it will give the service name a generic name - which isnt great. I see you have installed the SmartConnector in a unique folder, which is great, but I would go through the process of running the setup again (use 'arcsight agentsetup') and go through the process of making it stand alone (not having it run as a service) and then add it back in as a service - but make sure you give it a logical name such as 'Connector_Sophos' or something. That should be better.
seems the installation was not completed in first attempt, have faced the similar issue in checkpoint integration which resolved by deleting current folder and fresh installation.
Restart connector, while restarting delete the files agent*.lock, continuously. From location /ArcsightSmartconnectors/sophos/current/run/agent.lock.
Hope this helps.