Highlighted
Respected Contributor.. Respected Contributor..
Respected Contributor..
387 views

How resolve this error of "Make Searchable"?

My log have:

 

[2018-07-19 16:22:22,968][INFO ][EventArchiveUtil][pool-11-thread-1] EventArchive-com.arcsight.logger.eventarchive.EventArchiveUtil.updateDigest().line346: Updated the digest with /opt/arcsight/logger/data/archives/sg1/0648518346341351428/20180109/ArcSight_Data_22.dat
[2018-07-19 16:22:22,968][INFO ][EventArchiveUtil][pool-11-thread-1] EventArchive-com.arcsight.logger.eventarchive.EventArchiveUtil.updateDigest().line346: Updated the digest with /opt/arcsight/logger/data/archives/sg1/0648518346341351428/20180109/arc_event_annotation.gz
[2018-07-19 16:22:22,969][ERROR][EventArchiveSupplementalUtil][pool-11-thread-1] EventArchive-com.arcsight.logger.eventarchive.EventArchiveSupplementalUtil.verifySupplementalHash().line260: unable to load supplemental metadata
[2018-07-19 16:22:22,969][ERROR][EventArchiveManagerDelegateV6][pool-11-thread-1] EventArchive-com.arcsight.logger.eventarchive.delegates.EventArchiveManagerDelegateV6.verifyArchiveHash().line78: unable to load supplemental metadata
[2018-07-19 16:22:22,969][ERROR][EventArchiveManagerDelegateV6][pool-11-thread-1]
com.arcsight.common.exception.ArcSightException: unable to load supplemental metadata
at com.arcsight.logger.eventarchive.EventArchiveSupplementalUtil.verifySupplementalHash(EventArchiveSupplementalUtil.java:261)
at com.arcsight.logger.eventarchive.delegates.EventArchiveManagerDelegateV6.verifyArchiveHash(EventArchiveManagerDelegateV6.java:75)
at com.arcsight.logger.eventarchive.delegates.EventArchiveManagerDelegateBase.restoreData(EventArchiveManagerDelegateBase.java:47)
at com.arcsight.logger.eventarchive.EventArchiveManager.b(EventArchiveManager.java:337)
at com.arcsight.logger.eventarchive.ArchiveActionBase.a(ArchiveActionBase.java:132)
at com.arcsight.logger.eventarchive.ArchiveActionBase.run(ArchiveActionBase.java:167)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
at java.lang.Thread.run(Thread.java:745)
[2018-07-19 16:22:22,969][ERROR][EventArchiveManagerDelegateBase][pool-11-thread-1] EventArchive-com.arcsight.logger.eventarchive.delegates.EventArchiveManagerDelegateBase.restoreData().line56: Unexpected exception thrown while verifying the hash. Will fail the activation process.
[2018-07-19 16:22:22,969][ERROR][EventArchiveManagerDelegateBase][pool-11-thread-1] EventArchive-com.arcsight.logger.eventarchive.delegates.EventArchiveManagerDelegateBase.restoreData().line56: FAIL: DefaultEventArchive{name=20180109, storageGroupID=0648518346341351428, status=ARCHIVED, location=/opt/arcsight/logger/data/archives/sg1/0648518346341351428/20180109, counts=267760478, size=22531, info=TaskInfo{status=RUNNING, startTime=1532027873322, endTime=1532026541333, additionalInfo='FAIL: DefaultEventArchive{name=20180109, storageGroupID=0648518346341351428, status=ARCHIVED, location=/opt/arcsight/logger/data/archives/sg1/0648518346341351428/20180109, counts=267760478, size=22531, info=TaskInfo{status=RUNNING, startTime=1532026275506, endTime=1532026194362, additionalInfo='/opt/arcsight/logger/data/archives/sg1/0648518346341351428/20180109/ArcSight_Metadata_Archive.xml.gz (No such file or directory)', scheduledTime=1532026275503, action='ACTIVATE', cancelled=false}, hash=N1kdsyeJGc5yuAgwbHbn--S-Hi4DBvb69mGI-IreA74=, archivalTime=1515554017939, deactivationTime=0, activationTime=0, supplementalHash=7j+Y4vtCx9xWy3o2CY3ymYhqxNUmaRqlts3MQ7-Yf6s=} Couldn't verify the archive hashes. No events have been loaded.', scheduledTime=1532027873320, action='ACTIVATE', cancelled=false}, hash=N1kdsyeJGc5yuAgwbHbn--S-Hi4DBvb69mGI-IreA74=, archivalTime=1515554017939, deactivationTime=0, activationTime=0, supplementalHash=7j+Y4vtCx9xWy3o2CY3ymYhqxNUmaRqlts3MQ7-Yf6s=} Couldn't verify the archive hashes. No events have been loaded.
[2018-07-19 16:22:22,969][ERROR][EventArchiveManagerDelegateBase][pool-11-thread-1]
com.arcsight.common.exception.ArcSightException: FAIL: DefaultEventArchive{name=20180109, storageGroupID=0648518346341351428, status=ARCHIVED, location=/opt/arcsight/logger/data/archives/sg1/0648518346341351428/20180109, counts=267760478, size=22531, info=TaskInfo{status=RUNNING, startTime=1532027873322, endTime=1532026541333, additionalInfo='FAIL: DefaultEventArchive{name=20180109, storageGroupID=0648518346341351428, status=ARCHIVED, location=/opt/arcsight/logger/data/archives/sg1/0648518346341351428/20180109, counts=267760478, size=22531, info=TaskInfo{status=RUNNING, startTime=1532026275506, endTime=1532026194362, additionalInfo='/opt/arcsight/logger/data/archives/sg1/0648518346341351428/20180109/ArcSight_Metadata_Archive.xml.gz (No such file or directory)', scheduledTime=1532026275503, action='ACTIVATE', cancelled=false}, hash=N1kdsyeJGc5yuAgwbHbn--S-Hi4DBvb69mGI-IreA74=, archivalTime=1515554017939, deactivationTime=0, activationTime=0, supplementalHash=7j+Y4vtCx9xWy3o2CY3ymYhqxNUmaRqlts3MQ7-Yf6s=} Couldn't verify the archive hashes. No events have been loaded.', scheduledTime=1532027873320, action='ACTIVATE', cancelled=false}, hash=N1kdsyeJGc5yuAgwbHbn--S-Hi4DBvb69mGI-IreA74=, archivalTime=1515554017939, deactivationTime=0, activationTime=0, supplementalHash=7j+Y4vtCx9xWy3o2CY3ymYhqxNUmaRqlts3MQ7-Yf6s=} Couldn't verify the archive hashes. No events have been loaded.
at com.arcsight.logger.eventarchive.delegates.EventArchiveManagerDelegateBase.restoreData(EventArchiveManagerDelegateBase.java:53)
at com.arcsight.logger.eventarchive.EventArchiveManager.b(EventArchiveManager.java:337)
at com.arcsight.logger.eventarchive.ArchiveActionBase.a(ArchiveActionBase.java:132)
at com.arcsight.logger.eventarchive.ArchiveActionBase.run(ArchiveActionBase.java:167)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
at java.lang.Thread.run(Thread.java:745)
[2018-07-19 16:22:22,969][ERROR][ArchiveActionBase][pool-11-thread-1] EventArchive-com.arcsight.logger.eventarchive.ArchiveActionBase.a().line152: DefaultEventArchive{name=20180109, storageGroupID=0648518346341351428, status=ARCHIVED, location=/opt/arcsight/logger/data/archives/sg1/0648518346341351428/20180109, counts=267760478, size=22531, info=TaskInfo{status=RUNNING, startTime=1532027873322, endTime=1532026541333, additionalInfo='FAIL: DefaultEventArchive{name=20180109, storageGroupID=0648518346341351428, status=ARCHIVED, location=/opt/arcsight/logger/data/archives/sg1/0648518346341351428/20180109, counts=267760478, size=22531, info=TaskInfo{status=RUNNING, startTime=1532026275506, endTime=1532026194362, additionalInfo='/opt/arcsight/logger/data/archives/sg1/0648518346341351428/20180109/ArcSight_Metadata_Archive.xml.gz (No such file or directory)', scheduledTime=1532026275503, action='ACTIVATE', cancelled=false}, hash=N1kdsyeJGc5yuAgwbHbn--S-Hi4DBvb69mGI-IreA74=, archivalTime=1515554017939, deactivationTime=0, activationTime=0, supplementalHash=7j+Y4vtCx9xWy3o2CY3ymYhqxNUmaRqlts3MQ7-Yf6s=} Couldn't verify the archive hashes. No events have been loaded.', scheduledTime=1532027873320, action='ACTIVATE', cancelled=false}, hash=N1kdsyeJGc5yuAgwbHbn--S-Hi4DBvb69mGI-IreA74=, archivalTime=1515554017939, deactivationTime=0, activationTime=0, supplementalHash=7j+Y4vtCx9xWy3o2CY3ymYhqxNUmaRqlts3MQ7-Yf6s=}
[2018-07-19 16:22:22,969][ERROR][ArchiveActionBase][pool-11-thread-1] EventArchive-com.arcsight.logger.eventarchive.ArchiveActionBase.a().line152: FAIL: DefaultEventArchive{name=20180109, storageGroupID=0648518346341351428, status=ARCHIVED, location=/opt/arcsight/logger/data/archives/sg1/0648518346341351428/20180109, counts=267760478, size=22531, info=TaskInfo{status=RUNNING, startTime=1532027873322, endTime=1532026541333, additionalInfo='FAIL: DefaultEventArchive{name=20180109, storageGroupID=0648518346341351428, status=ARCHIVED, location=/opt/arcsight/logger/data/archives/sg1/0648518346341351428/20180109, counts=267760478, size=22531, info=TaskInfo{status=RUNNING, startTime=1532026275506, endTime=1532026194362, additionalInfo='/opt/arcsight/logger/data/archives/sg1/0648518346341351428/20180109/ArcSight_Metadata_Archive.xml.gz (No such file or directory)', scheduledTime=1532026275503, action='ACTIVATE', cancelled=false}, hash=N1kdsyeJGc5yuAgwbHbn--S-Hi4DBvb69mGI-IreA74=, archivalTime=1515554017939, deactivationTime=0, activationTime=0, supplementalHash=7j+Y4vtCx9xWy3o2CY3ymYhqxNUmaRqlts3MQ7-Yf6s=} Couldn't verify the archive hashes. No events have been loaded.', scheduledTime=1532027873320, action='ACTIVATE', cancelled=false}, hash=N1kdsyeJGc5yuAgwbHbn--S-Hi4DBvb69mGI-IreA74=, archivalTime=1515554017939, deactivationTime=0, activationTime=0, supplementalHash=7j+Y4vtCx9xWy3o2CY3ymYhqxNUmaRqlts3MQ7-Yf6s=} Couldn't verify the archive hashes. No events have been loaded.
[2018-07-19 16:22:22,970][ERROR][ArchiveActionBase][pool-11-thread-1]
com.arcsight.common.exception.ArcSightException: FAIL: DefaultEventArchive{name=20180109, storageGroupID=0648518346341351428, status=ARCHIVED, location=/opt/arcsight/logger/data/archives/sg1/0648518346341351428/20180109, counts=267760478, size=22531, info=TaskInfo{status=RUNNING, startTime=1532027873322, endTime=1532026541333, additionalInfo='FAIL: DefaultEventArchive{name=20180109, storageGroupID=0648518346341351428, status=ARCHIVED, location=/opt/arcsight/logger/data/archives/sg1/0648518346341351428/20180109, counts=267760478, size=22531, info=TaskInfo{status=RUNNING, startTime=1532026275506, endTime=1532026194362, additionalInfo='/opt/arcsight/logger/data/archives/sg1/0648518346341351428/20180109/ArcSight_Metadata_Archive.xml.gz (No such file or directory)', scheduledTime=1532026275503, action='ACTIVATE', cancelled=false}, hash=N1kdsyeJGc5yuAgwbHbn--S-Hi4DBvb69mGI-IreA74=, archivalTime=1515554017939, deactivationTime=0, activationTime=0, supplementalHash=7j+Y4vtCx9xWy3o2CY3ymYhqxNUmaRqlts3MQ7-Yf6s=} Couldn't verify the archive hashes. No events have been loaded.', scheduledTime=1532027873320, action='ACTIVATE', cancelled=false}, hash=N1kdsyeJGc5yuAgwbHbn--S-Hi4DBvb69mGI-IreA74=, archivalTime=1515554017939, deactivationTime=0, activationTime=0, supplementalHash=7j+Y4vtCx9xWy3o2CY3ymYhqxNUmaRqlts3MQ7-Yf6s=} Couldn't verify the archive hashes. No events have been loaded.
at com.arcsight.logger.eventarchive.delegates.EventArchiveManagerDelegateBase.restoreData(EventArchiveManagerDelegateBase.java:53)
at com.arcsight.logger.eventarchive.EventArchiveManager.b(EventArchiveManager.java:337)
at com.arcsight.logger.eventarchive.ArchiveActionBase.a(ArchiveActionBase.java:132)
at com.arcsight.logger.eventarchive.ArchiveActionBase.run(ArchiveActionBase.java:167)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
at java.lang.Thread.run(Thread.java:745)
[2018-07-19 16:22:24,858][INFO ][CDistributedSearchRequestFactory][pool-6-thread-1] retrieve ROS search result: SearchManager:7432
[2018-07-19 16:22:24,899][INFO ][CDistributedSearchRequestFactory][pool-6-thread-4] end ROS search: SearchManager:7432|524295459|4027640|0
[2018-07-19 16:22:24,899][INFO ][CDistributedSearchGetMetadataEndCommand][pool-6-thread-4] search session is finished: SearchManager:7432
[2018-07-19 16:22:25,055][INFO ][CDistributedSearchRequestFactory][pool-6-thread-3] ping server: arc_event||524295460|
[2018-07-19 16:22:25,096][INFO ][CDistributedSearchRequestFactory][pool-6-thread-2] request ROS/WOS decision: arc_event|event_id,end_time,name,priority,session_id|524295460|
[2018-07-19 16:22:25,106][WARN ][Search3gMgr][pool-6-thread-2] cant find event searcher
[2018-07-19 16:22:25,106][INFO ][CDistributedSearchColumnCheckCommand][pool-6-thread-2] API isROS() = true
[2018-07-19 16:22:25,106][INFO ][CDistributedSearchColumnCheckCommand][pool-6-thread-2] Search Decision = ROS for (event_id,end_time,name,priority,session_id)
[2018-07-19 16:22:25,107][INFO ][CDistributedSearchColumnCheckCommand][pool-6-thread-2] total device filter = (+)0 (-)0
[2018-07-19 16:22:25,146][INFO ][CDistributedSearchRequestFactory][pool-6-thread-1] init ROS search: arc_event|event_id,end_time,name,priority,session_id|524295460||1,1,0|{"op":"AND","args":[{"op":"IN","field":"name","args":["COS - CCD: Uso de programa de edicao em arquivo de Configuracao"]},{"op":"BETWEEN","field":"end_time","args":[1531183120191,1531183629650]}]}
[2018-07-19 16:22:25,148][INFO ][CDistributedSearchGetMetadataInitCommand][pool-6-thread-1] start=1531183120191; end=1531183629651
[2018-07-19 16:22:25,148][INFO ][CDistributedSearchGetMetadataInitCommand][pool-6-thread-1] EndTime
[2018-07-19 16:22:25,148][WARN ][Search3gMgr][pool-6-thread-1] cant find event searcher
[2018-07-19 16:22:25,150][INFO ][ReadStoreMgr][pool-6-thread-1] SessionID 524295460 checking master superindex
[2018-07-19 16:22:25,190][INFO ][CDistributedSearchRequestFactory][pool-6-thread-4] retrieve ROS search result: SearchManager:7433
[2018-07-19 16:22:25,399][INFO ][ColumnChunkIterator][pool-6-thread-4] get results 740 takes 209
[2018-07-19 16:22:25,399][INFO ][CDistributedSearchGetMetadataCommand2][pool-6-thread-4] columns size = 7
[2018-07-19 16:22:25,399][INFO ][CDistributedSearchGetMetadataCommand2][pool-6-thread-4] dataFile = /opt/arcsight/logger/data/logger/Arcsight_Data_15518, eventCount = 513, Offset = 292548238, Length = 51188, header length= 386
[2018-07-19 16:22:25,401][INFO ][CDistributedSearchGetMetadataCommand2][pool-6-thread-4] sending 740 datachunks
[2018-07-19 16:22:28,006][INFO ][cb][pool-12-thread-2] It takes 0 millis to get first event time for file:3
[2018-07-19 16:22:28,007][INFO ][cb][pool-12-thread-2] The first MRT in online store is updated. The new value (in GMT) is 0
[2018-07-19 16:22:28,007][INFO ][cb][pool-12-thread-2] It takes 0 millis to get first event time for file:3
[2018-07-19 16:22:28,007][INFO ][cb][pool-12-thread-2] The first MRT in online store is updated. The new value (in GMT) is 0
[2018-07-19 16:22:29,429][INFO ][CDistributedSearchRequestFactory][pool-6-thread-3] retrieve ROS search result: SearchManager:7433
[2018-07-19 16:22:29,471][INFO ][CDistributedSearchRequestFactory][pool-6-thread-2] end ROS search: SearchManager:7433|524295460|3691707|0
[2018-07-19 16:22:29,471][INFO ][CDistributedSearchGetMetadataEndCommand][pool-6-thread-2] search session is finished: SearchManager:7433
[2018-07-19 16:22:29,626][INFO ][CDistributedSearchRequestFactory][pool-6-thread-1] ping server: arc_event||524295461|
[2018-07-19 16:22:29,667][INFO ][CDistributedSearchRequestFactory][pool-6-thread-4] request ROS/WOS decision: arc_event|event_id,end_time,name,priority,session_id|524295461|
[2018-07-19 16:22:29,676][WARN ][Search3gMgr][pool-6-thread-4] cant find event searcher
[2018-07-19 16:22:29,677][INFO ][CDistributedSearchColumnCheckCommand][pool-6-thread-4] API isROS() = true
[2018-07-19 16:22:29,677][INFO ][CDistributedSearchColumnCheckCommand][pool-6-thread-4] Search Decision = ROS for (event_id,end_time,name,priority,session_id)
[2018-07-19 16:22:29,677][INFO ][CDistributedSearchColumnCheckCommand][pool-6-thread-4] total device filter = (+)0 (-)0
[2018-07-19 16:22:29,718][INFO ][CDistributedSearchRequestFactory][pool-6-thread-3] init ROS search: arc_event|event_id,end_time,name,priority,session_id|524295461||1,1,0|{"op":"AND","args":[{"op":"IN","field":"name","args":["COS - CCD: Uso de programa de edicao em arquivo de Configuracao"]},{"op":"BETWEEN","field":"end_time","args":[1531182610731,1531183120190]}]}
[2018-07-19 16:22:29,719][INFO ][CDistributedSearchGetMetadataInitCommand][pool-6-thread-3] start=1531182610731; end=1531183120191
[2018-07-19 16:22:29,719][INFO ][CDistributedSearchGetMetadataInitCommand][pool-6-thread-3] EndTime
[2018-07-19 16:22:29,719][WARN ][Search3gMgr][pool-6-thread-3] cant find event searcher
[2018-07-19 16:22:29,721][INFO ][ReadStoreMgr][pool-6-thread-3] SessionID 524295461 checking master superindex
[2018-07-19 16:22:29,761][INFO ][CDistributedSearchRequestFactory][pool-6-thread-2] retrieve ROS search result: SearchManager:7434
[2018-07-19 16:22:30,001][INFO ][ColumnChunkIterator][pool-6-thread-2] get results 779 takes 239
[2018-07-19 16:22:30,001][INFO ][CDistributedSearchGetMetadataCommand2][pool-6-thread-2] columns size = 7
[2018-07-19 16:22:30,001][INFO ][CDistributedSearchGetMetadataCommand2][pool-6-thread-2] dataFile = /opt/arcsight/logger/data/logger/Arcsight_Data_15518, eventCount = 2773, Offset = 220750950, Length = 203358, header length= 444
[2018-07-19 16:22:30,003][INFO ][CDistributedSearchGetMetadataCommand2][pool-6-thread-2] sending 779 datachunks
[2018-07-19 16:22:31,557][INFO ][Server][Timer-1] server_stats[serverstats]: {sg2PctUsed=62, RBps(SLC)=0, TotalWriteTime=9379904, TotalReadCount=39759, TotalBytesWritten=162561658213, TotalBytesRead=117820342, sg3PctUsed=32, WBps(SLC)=2073175, TotalReadTime=2225, sg1PctUsed=51, InternalEventStorageGroupPctUsed=20, sg4PctUsed=12, DefaultStorageGroupPctUsed=26, TotalWriteCount=755108}
^C

 

How resolve this? The HASH could be the motive of error, which hash is that?

 

Thanks

Fred Henrique

0 Likes
1 Reply
Highlighted
Micro Focus Expert
Micro Focus Expert

Re: How resolve this error of "Make Searchable"?

You copy pasted this question somewhere else, and it was already answered there 🙂

https://community.softwaregrp.com/t5/ArcSight-User-Discussions/How-activate-my-restored-events-ESM-6-8/m-p/1656530/thread-id/43421

-----------------------------------------------------------------------------------------
All topics and replies made is based on my personal opinion, viewpoint and experience, it does not represent the viewpoints of MicroFocus.
All replies is based on best effort, and can not be taken as official support replies.
//Marius
0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.