sakalet Absent Member.
Absent Member.
1524 views

I can't import Package(.arb) to ESM6.5c SP1

Jump to solution

I try import Package to ESM 6.5c SP1 on Console and It's show error:

Capture.PNG

and I try use command /opt/arcsight/manager/bin/arcsight package -action import -f Backup.arb -u admin -p <password> -m <hostname> and it's show error:

---------------------------------------------------------------------------

com.arcsight.common.packageresource.PackageException: Stopping after fatal error: The element type "value" must be terminated by the matching end-tag "</value>".

        at com.arcsight.common.packageresource.bundle.RemoteImportPackageBundle.importPackageBundle(RemoteImportPackageBundle.java:316)

        at com.arcsight.common.persist.remote.RemotePackageResourceBroker.importPackagesForBundle(RemotePackageResourceBroker.java:133)

        at com.arcsight.common.packageresource.manager.PackageCommandExecutor$ImportPackageCommand.execute(PackageCommandExecutor.java:370)

        at com.arcsight.common.packageresource.manager.PackageCommandExecutor.execute(PackageCommandExecutor.java:104)

        at com.arcsight.common.packageresource.manager.PackageCommandExecutor.importPackage(PackageCommandExecutor.java:161)

        at com.arcsight.common.packageresource.PackageUtility.importPackageBundle(PackageUtility.java:2583)

        at com.arcsight.common.packageresource.PackageUtility.process(PackageUtility.java:1131)

        at com.arcsight.common.packageresource.PackageUtility.main(PackageUtility.java:414)

Caused by: com.arcsight.common.ArcSightException: Stopping after fatal error: The element type "value" must be terminated by the matching end-tag "</value>".

        at helma.xmlrpc.XmlRpcClient$Worker.remoteExceptionFound(Unknown Source)

        at helma.xmlrpc.XmlRpcClient$Worker.getExceptionFromFaultMap(Unknown Source)

        at helma.xmlrpc.XmlRpcClient$Worker.faultFound(Unknown Source)

        at helma.xmlrpc.XmlRpcClient$Worker.execute(Unknown Source)

        at helma.xmlrpc.XmlRpcClient.execute(Unknown Source)

        at com.arcsight.manager.XmlRpcManager.privateExecute(XmlRpcManager.java:480)

        at com.arcsight.manager.XmlRpcManager.execute(XmlRpcManager.java:282)

        at com.arcsight.common.packageresource.bundle.RemoteImportPackageBundle.importPackageBundle(RemoteImportPackageBundle.java:252)

        ... 7 more

Failure During Packaging Process:ArcSightException:Stopping after fatal error: The element type "value" must be terminated by the matching end-tag "</value>".

---------------------------------------------------------------------------

Import Failed. Elapsed Packaging Time:7 secs 982 ms


File(.arb) size : 37MB

Please Help me

Thank You

Labels (1)
Tags (3)
0 Likes
1 Solution

Accepted Solutions
sakalet Absent Member.
Absent Member.

Re: I can't import Package(.arb) to ESM6.5c SP1

Jump to solution

Edit Package :>/opt/arcsight/manager/bin/script/package.sh

        vim edit Line 22 : ARCSIGHT_JVM_OPTIONS="-Xms32m -Xmx256m" To ARCSIGHT_JVM_OPTIONS="-Xms32m -Xmx2048m"


        Use User as root

        Run Command : /opt/arcsight/manager/bin/arcsight package -action import -f <filename .arb NOT USE PART> -u <username> -p <password> -m <hostname or name manager> -standalone

       

        Wait System Running and It's show Import Complete


Edit File console 😆C:\arcsight\Console6.5SP1\current\bin\scripts\console.bat

        Open File & Edit Line 27: set ARCSIGHT_JVM_OPTIONS=-Xms64m -Xmx256m  -XX:MaxPermSize=128m -XX:-UseThreadPriorities -XX:+HeapDumpOnOutOfMemoryError -Dsun.java2d.noddraw=true To  set ARCSIGHT_JVM_OPTIONS=-Xms64m -Xmx1024m  -XX:MaxPermSize=128m -XX:-UseThreadPriorities -XX:+HeapDumpOnOutOfMemoryError -Dsun.java2d.noddraw=true

        Edit server.default.properties 😆 /opt/arcsight/manager/config/server.defaults.properties

        vim edit Line 1046 :  persist.file.size.max=30 To persist.file.size.max=90

        vim edit Line 1079
persist.package.uninstall.max.batch.retrieve=1000

To persist.package.uninstall.max.batch.retrieve=10000

​​        vim edit Line 1152
archive.export.max.size=30000

To archive.export.max.size=90000     ​

​​        vim edit Line 1647

resource.broker.cache.size=1000

To resource.broker.cache.size=10000   ​

        Restart ArcSight Service : /etc/init.d/arcsight_services restart

        Open ArcSight Console and install Package

0 Likes
5 Replies
Highlighted
dcorwin25 Honored Contributor.
Honored Contributor.

Re: I can't import Package(.arb) to ESM6.5c SP1

Jump to solution

Have you tried restarting the manager and then re-attempting the install?

0 Likes
rhope Acclaimed Contributor.
Acclaimed Contributor.

Re: I can't import Package(.arb) to ESM6.5c SP1

Jump to solution

Looks like the XML contained within the arb is incorrectly formatted (missing a closing tag) has it been manually edited?

0 Likes
anirudhanayak@g Outstanding Contributor.
Outstanding Contributor.

Re: I can't import Package(.arb) to ESM6.5c SP1

Jump to solution

Try to follow the steps mentioned in the document below.

Regards,

Anirudh

0 Likes
sakalet Absent Member.
Absent Member.

Re: I can't import Package(.arb) to ESM6.5c SP1

Jump to solution

Edit Package :>/opt/arcsight/manager/bin/script/package.sh

        vim edit Line 22 : ARCSIGHT_JVM_OPTIONS="-Xms32m -Xmx256m" To ARCSIGHT_JVM_OPTIONS="-Xms32m -Xmx2048m"


        Use User as root

        Run Command : /opt/arcsight/manager/bin/arcsight package -action import -f <filename .arb NOT USE PART> -u <username> -p <password> -m <hostname or name manager> -standalone

       

        Wait System Running and It's show Import Complete


Edit File console 😆C:\arcsight\Console6.5SP1\current\bin\scripts\console.bat

        Open File & Edit Line 27: set ARCSIGHT_JVM_OPTIONS=-Xms64m -Xmx256m  -XX:MaxPermSize=128m -XX:-UseThreadPriorities -XX:+HeapDumpOnOutOfMemoryError -Dsun.java2d.noddraw=true To  set ARCSIGHT_JVM_OPTIONS=-Xms64m -Xmx1024m  -XX:MaxPermSize=128m -XX:-UseThreadPriorities -XX:+HeapDumpOnOutOfMemoryError -Dsun.java2d.noddraw=true

        Edit server.default.properties 😆 /opt/arcsight/manager/config/server.defaults.properties

        vim edit Line 1046 :  persist.file.size.max=30 To persist.file.size.max=90

        vim edit Line 1079
persist.package.uninstall.max.batch.retrieve=1000

To persist.package.uninstall.max.batch.retrieve=10000

​​        vim edit Line 1152
archive.export.max.size=30000

To archive.export.max.size=90000     ​

​​        vim edit Line 1647

resource.broker.cache.size=1000

To resource.broker.cache.size=10000   ​

        Restart ArcSight Service : /etc/init.d/arcsight_services restart

        Open ArcSight Console and install Package

0 Likes
psandeep08 Absent Member.
Absent Member.

Re: I can't import Package(.arb) to ESM6.5c SP1

Jump to solution

Can anyone please help me to resolve this error. Am trying to import the Anomalous Traffic Detection package from HPE marketplace.

Could not determine package installation requirements: com.arcsight.common.persist.PersistenceException:

Exception on server: com.arcsight.common.archive.ConflictAbortedException:

Package permissions for 'ArcSight Core' could not be resolved

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.