Issues with "Update Agent" on Hosts (ArcMC and Loggers)

[siemops]

We recently upgraded our single ArcMC from version 2.2.0.1646.0 to version 2.2.0.1699.1. After we upgraded, we tried to "Update Agent", locally, on this ArcMC...and also tried "Update Agent" on the Loggers (all running version 6.1.0.7491.0). We received the same error on both attempts: "Error while executing 'Agent Upgrade' on the node: (insert either ArcSight component name and type here) update installation script failed to run.Could not find the res file". We ended-up manually uninstalling the old ArcMC Agent, on the local ArcMC, and manually installing the new ArcMC Agent (version 2.2.0.1234.1). However, we still have the same errors/issues trying to perform "Update Agent" on our Loggers from ArcMC.

Any thoughts?

[siemops · Accepted solution]

We discovered that our install of CentOS 7.2, that our ArcMC runs-on, did not have PERL installed. Also, we were missing a PERL module on the Loggers. Once these items were installed, it worked.

[mr7]

@siemops I am facing the same issue. We have rhel 7.6. Could please specify the Perl Package to be installed.

Thanks in advance!

[pbrettle]

Good to know it was so simple - I was getting worried there was a problem there. I am not a fan of the agent approach for managing software components, but hey, its what we have.

[muratekren]

Hi Richard do you remember which perl module was missing ? getting the same error, couldn't find any clue for the perl module in the logs.

[siemops]

Our install of ArcMC was missing PERL completely (our bad...we installed the OS for ArcMC). The Loggers, installed via ArcSight's OVA file,  were missing the perl-Carp module.

To resolve our Loggers:

yum install perl-Carp

[AS_User]

Hi guys, we were concerned about installing perl packages and its dependencies so we installed with yum, upgraded the agent remotely, then did a yum history undo <transaction id> to remove perl and all the associated packages as it was before and everything still worked.

We even did a service restart of the loggers and all good.

[siemops]

Since the perl modules are now removed, after the agents were updated/upgraded remotely, it will be interesting to know whether you can update/upgrade the agents, remotely, in the future.

[AS_User]

Hi Richard, I suspect not, but it really was a 2 minute task to install and remove...you can see in the log that the remote push of an upgrade attempts to run a perl script so im confident it wont work unless this mechanism changes from ArcSight.

The interesting point for us is that we're installing for a client at the moment, its not a live system so not under change control...when we are live we might need to think again.

T