Issue with the Global Summary Persistance feature (affects Logger v 5.3)
We have identified an issue with the new global summary persistence functionality in version 5.3 of Logger. This feature causes the statistics reported in the global summary section of Logger to persist through a reboot. The ArcSight Support team has seen incidents where disk space has been affected due to this feature. We recommend that customers using Logger v 5.3 turn off this feature until we identify and fix the root cause.
Please refer to the Support Knowledge Base Article for a script that turns off this feature. http://support.openview.hp.com/selfsolve/document/KM00301166
Applying this script will cause the auto complete for field values to stop working. The auto complete for full text tokens will continue to work.
Product Manager, HP ArcSight Logger
This patch is highly recommended as without it there is a very high risk of Logger 5.3 running out of space, falling over and then requiring Support assistance to get it back up again (which is a timely process).
I tried to apply this update immediately after a Logger reboot following this appliance being successfully upgraded to 5.3, but I found that when I tried navigating to 'System Admin > License & Update', I immediately got an error window saying "Operation failed due to system error. Please check the server logs.". Has anyone else come across this?
Doug, if you were not yet able to apply the GSP patch yet, then this error may be due to a failed 5.3 upgrade. Please raise an incident with Arcsight Support to investigate further.
Thanks, yes I already have an incident raised with ArcSight Support regarding this issue. The weird thing is, during the Logger 5.3 upgrade I had no problems reported, it appeared to upgrade no problem. I just get this message when I click on the 'License & Update' link.
We are hit by this bug.....
TAC supprt has suggested to take the backup of logger DB, before that we need to turn off GSP & stop Postgres on logger.
Post this we need to apply the disableGS.enc to the Logger and reboot.
We are in a process of doing this.
Have anybody encountered the same problem.Can you share your findings.
I had the same problem with my logger appliance 5.3 SAN But the procedure that you indicated doesn't work for my case.
In your case, can you solve after applied patch?