Absent Member.
Absent Member.
590 views

Finding containing resource for parameter

Jump to solution

The log messages for this type of errors in server.log yield no useful information other than the type of error and parameter name.

"[ERROR][default.com.arcsight.common.introspection.dependentvariable.TypeConversionFunctionField] The parameter [CI] cannot be converted to a number by the variable [convert_string_to_integer]. The NumberFormatException has occured 69 times since the error was last logged"


The parameter names are not search able values in search console bar.


Short of packaging everything up into an ARB unpacking and grepping for the parameter name, is there any method of finding the containing resource.


Ideally the log message should contain the parent resource ID, that would solve this problem and many other difficulties when resolving issues raised in the logs.


Oh also occurred is spelled incorrectly in the error message.

"... The NumberFormatException has occured 69 times since the error was last logged"

Labels (1)
0 Likes
1 Solution

Accepted Solutions
Fleet Admiral
Fleet Admiral

Hi Mike,

When the ESM console search fails me, the next step is to do one of two things:

1) Log into the ESM mysql db and search for the resource via SQL (see attached PDF for full details)

https://protect724.hp.com/servlet/JiveServlet/download/51257-15228/TT3156%20-%20ESM%20administration%20from%20Oracle%20to%20MySQL%20-%20Kerry%20Adkin.pdf

/opt/arcsight/logger/current/arcsight/bin/mysql –u arcsight –p

select * from arc_resource where name = 'convert_string_to_integer'

Found a snapshot of the schema that you'll most likely have to check:

Deeee.JPG

2) Export system tables and grep through there - slightly easier than packaging everything up in an ARB, so long as your can shut down the DB (may not be an option in prod environments)

/arcsight export_system_tables arcsight <password> arcsight

View solution in original post

0 Likes
6 Replies
Fleet Admiral
Fleet Admiral

Hi Mike,

When the ESM console search fails me, the next step is to do one of two things:

1) Log into the ESM mysql db and search for the resource via SQL (see attached PDF for full details)

https://protect724.hp.com/servlet/JiveServlet/download/51257-15228/TT3156%20-%20ESM%20administration%20from%20Oracle%20to%20MySQL%20-%20Kerry%20Adkin.pdf

/opt/arcsight/logger/current/arcsight/bin/mysql –u arcsight –p

select * from arc_resource where name = 'convert_string_to_integer'

Found a snapshot of the schema that you'll most likely have to check:

Deeee.JPG

2) Export system tables and grep through there - slightly easier than packaging everything up in an ARB, so long as your can shut down the DB (may not be an option in prod environments)

/arcsight export_system_tables arcsight <password> arcsight

View solution in original post

0 Likes
Absent Member.
Absent Member.

Thanks, That is handy to know. I also found out that the 'Resource Search Bar' can find references to function names. The query you supplied does not, so there is probably another table out there where it can be found. I just assumed references to called functions could not be searched for.

0 Likes
Fleet Admiral
Fleet Admiral

Oh i think i get you... 'convert_string_to_integer' is a function, not a local variable. So were you able to find your root issue?

0 Likes
Absent Member.
Absent Member.

Yea, I did. LIttle newish to the CORR been meaning to dig around in the databases. MySQL is a nice change from Oracle. Would be even nicer if they swung everything to PostgreSQL.

Thanks

0 Likes
Fleet Admiral
Fleet Admiral

Glad you got it resolved.

0 Likes
Absent Member.
Absent Member.

Hi Mike,

If the replies were able to answer your question, please mark your question as answered.

Thanks!

Alexandra

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.