Has anyone moved the /opt/arcsight/logger/data/mysql partition in ESM 6.8?
I'm running into a disk space issue; even with "sort_temp_limit" cranked up. The bottom line is that even with 460GB free in /opt/arcsight I'm running out of room to run reports. If "sort_temp_limit" is set larger than what is actually free on the disk, I run into some errors. If I set it more appropriately, I still get other errors. I do not have the option of reducing retention time for my events, which would free up space.
$REPORT could not be archived.
Reason: com.arcsight.server.reports.ReportException: Got exception from separate report server process: inetsoft.sree.RepletException: Failed to create report: com.arcsight.server.reports.ReportGenerationException: Encountered persistence problem while fetching data: Unable to execute query: Error writing file '/opt/arcsight/logger/data/mysql/MYSJvwzS' (Errcode: 28)
This leads me to two questions; can /opt/arcsight/logger/data/mysql be set up as a mount point on a new filesystem? This would give MySQL its own "playpen" if you will. It should be transparent to the rest of ArcSight and the OS. I'm curious if anyone has done this and if you have any success or horror stories.
The other solution could be with the way that MySQL is executed by ArcSight. It seems to be called from the CLI with a "--tmpdir" set. Could that tmpdir be set to another drive/partition that has free space? Has anyone tried this?
arcsight 79547 632 52.4 321880172 276331180 ? Sl Jun01 72191:43 /opt/arcsight/logger/current/local/mysql/libexec/mysqld --defaults-file=/opt/arcsight/logger/current/../data/mysql/my.cnf --basedir=/opt/arcsight/logger/current/local/mysql --datadir=/opt/arcsight/logger/current/../data/mysql --pid-file=/opt/arcsight/logger/current/runtime/mysql_server.pid --tmpdir=/opt/arcsight/logger/current/../data/mysql --port=3306 --socket=/opt/arcsight/logger/current/runtime/mysql.sock
Re: Has anyone moved the /opt/arcsight/logger/data/mysql partition in ESM 6.8?
My short-term solution, thanks to my SAN admin, was to cough up 2TB that we could use. I mounted that in a new location and then configured the MySQL startup script to use "tmpdir" as my new SAN mount. This is obviously not supported by HPE, but it fixed one of my two major problems.
The script I had to edit was /opt/arcsight/logger/current/arcsight/service/mysql_ctl