Highlighted
katzmandu1 Absent Member.
Absent Member.
483 views

Has anyone moved the /opt/arcsight/logger/data/mysql partition in ESM 6.8?

I'm running into a disk space issue; even with "sort_temp_limit" cranked up. The bottom line is that even with 460GB free in /opt/arcsight I'm running out of room to run reports. If "sort_temp_limit" is set larger than what is actually free on the disk, I run into some errors. If I set it more appropriately, I still get other errors. I do not have the option of reducing retention time for my events, which would free up space.

$REPORT could not be archived.

Reason: com.arcsight.server.reports.ReportException: Got exception from separate report server process: inetsoft.sree.RepletException: Failed to create report: com.arcsight.server.reports.ReportGenerationException: Encountered persistence problem while fetching data: Unable to execute query: Error writing file '/opt/arcsight/logger/data/mysql/MYSJvwzS' (Errcode: 28)

          

This leads me to two questions; can /opt/arcsight/logger/data/mysql be set up as a mount point on a new filesystem? This would give MySQL its own "playpen" if you will. It should be transparent to the rest of ArcSight and the OS. I'm curious if anyone has done this and if you have any success or horror stories.

The other solution could be with the way that MySQL is executed by ArcSight. It seems to be called from the CLI with a "--tmpdir" set. Could that tmpdir be set to another drive/partition that has free space? Has anyone tried this?

arcsight  79547  632 52.4 321880172 276331180 ? Sl   Jun01 72191:43 /opt/arcsight/logger/current/local/mysql/libexec/mysqld --defaults-file=/opt/arcsight/logger/current/../data/mysql/my.cnf --basedir=/opt/arcsight/logger/current/local/mysql --datadir=/opt/arcsight/logger/current/../data/mysql --pid-file=/opt/arcsight/logger/current/runtime/mysql_server.pid --tmpdir=/opt/arcsight/logger/current/../data/mysql --port=3306 --socket=/opt/arcsight/logger/current/runtime/mysql.sock

Thanks!

Labels (3)
Tags (3)
0 Likes
1 Reply
katzmandu1 Absent Member.
Absent Member.

Re: Has anyone moved the /opt/arcsight/logger/data/mysql partition in ESM 6.8?

My short-term solution, thanks to my SAN admin, was to cough up 2TB that we could use. I mounted that in a new location and then configured the MySQL startup script to use "tmpdir" as my new SAN mount. This is obviously not supported by HPE, but it fixed one of my two major problems.

The script I had to edit was /opt/arcsight/logger/current/arcsight/service/mysql_ctl

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.