Finding containing resource for parameter

[mmaul]

The log messages for this type of errors in server.log yield no useful information other than the type of error and parameter name.

"[ERROR][default.com.arcsight.common.introspection.dependentvariable.TypeConversionFunctionField] The parameter [CI] cannot be converted to a number by the variable [convert_string_to_integer]. The NumberFormatException has occured 69 times since the error was last logged"

The parameter names are not search able values in search console bar.

Short of packaging everything up into an ARB unpacking and grepping for the parameter name, is there any method of finding the containing resource.

Ideally the log message should contain the parent resource ID, that would solve this problem and many other difficulties when resolving issues raised in the logs.

Oh also occurred is spelled incorrectly in the error message.

"... The NumberFormatException has occured 69 times since the error was last logged"

[rkent1 · Accepted solution]

Hi Mike,

When the ESM console search fails me, the next step is to do one of two things:

1) Log into the ESM mysql db and search for the resource via SQL (see attached PDF for full details)

https://protect724.hp.com/servlet/JiveServlet/download/51257-15228/TT3156%20-%20ESM%20administration%20from%20Oracle%20to%20MySQL%20-%20Kerry%20Adkin.pdf

/opt/arcsight/logger/current/arcsight/bin/mysql –u arcsight –p

select * from arc_resource where name = 'convert_string_to_integer'

Found a snapshot of the schema that you'll most likely have to check:

2) Export system tables and grep through there - slightly easier than packaging everything up in an ARB, so long as your can shut down the DB (may not be an option in prod environments)

/arcsight export_system_tables arcsight <password> arcsight

[mmaul]

Thanks, That is handy to know. I also found out that the 'Resource Search Bar' can find references to function names. The query you supplied does not, so there is probably another table out there where it can be found. I just assumed references to called functions could not be searched for.

[rkent1]

Oh i think i get you... 'convert_string_to_integer' is a function, not a local variable. So were you able to find your root issue?

[mmaul]

Yea, I did. LIttle newish to the CORR been meaning to dig around in the databases. MySQL is a nice change from Oracle. Would be even nicer if they swung everything to PostgreSQL.

Thanks

[rkent1]

Glad you got it resolved.

[alomotan]

Hi Mike,

If the replies were able to answer your question, please mark your question as answered.

Thanks!

Alexandra