Absent Member.
Absent Member.
775 views

Logger search painfully slow with v5.2

Has anyone else upgraded their hardware logger to v5.2? A simple '2 minute' timeframe search takes 2 minutes to search through 135k records.

This type of search would take about 2 seconds to run under v5.1 on my L3200 logger.

Chris

Labels (1)
0 Likes
10 Replies
Fleet Admiral
Fleet Admiral

My logger is slow after the upgrade to 5.2 as well, there is a lot of data in it but before the upgrade it was definitely much faster.

0 Likes
Absent Member.
Absent Member.

indeed, several Logger customers have reported a degradation of search performance after upgrading to Logger 5.2, and ArcSight has confirmed and isolated the issue, and already developed and tested a hotfix.  the issue exhibits itself with certain datasets (typically large datasets and with certain search queries that result in a very large # of hits).  A hotfix has recently been released and is available for customers that have already upgraded.  The hotfix Read-me contains the details, and we have also sent a proactive announcement to all customers.  If you have already upgraded and are experiencing search performance degradation, then you can apply the hotfix.  if you have upgraded and are not seeing significant degradation, there is no reason to apply the hotfix.

For customers that have not yet upgraded, we recommend that you wait until a full patch is available, early in the new year.

Regards,

Alan Bavosa

Director, Product Management – HP Enterprise Security (ArcSight)

0 Likes
Absent Member.
Absent Member.

Hello,

As I'm still facing issues to access the Arcsight HP support portal, I can't download the hotfix to solve the search performance issue on the Logger 5.2.

Could anybody provide me this hotfix?

Regards,

Xavier

0 Likes
Absent Member.
Absent Member.

Xavier,

somebody will get back to you to figure out why you can't access the patch.  stay tuned.

Alan

Alan Bavosa

ArcSight, Inc., an HP Company

Director, Product Management

0 Likes
Absent Member.
Absent Member.

Hi Xavier,

Even though you are facing issues with the HP SSO portal, I have opened a trust case with support with an engineer to reach out to you and provide you with the correct files.


Best regards,

Carl Hoffmann
Customer Advocate
Technical Customer Support
ArcSight, Inc., an HP Company
Support Hotline: +1 866.535.3285

0 Likes
Absent Member.
Absent Member.

Xavier,

If you have access to https://arcsight.subscribenet.com/ , you may still be able to download the patch from there.

Chris

0 Likes
Absent Member.
Absent Member.

Stupid me! I did not test this URL! I still have access but... I can't find the Logger hot-fix!?

0 Likes
Fleet Admiral Fleet Admiral
Fleet Admiral

Hi,

this was really crap, we had the same issue and then we got the hint "use the old portal!", we need to sort that out.

Volker

0 Likes
Absent Member.
Absent Member.

In my case, the only way to solve this was to use a customer SAID and link it to my account (partner)...

/x

0 Likes
Absent Member.
Absent Member.

I've recently downloaded the free version of the logger to test in our environment, and I'm seeing really slow performance using the API to query the logger: 14 minutes to pull back 10,000 alerts.  Is this related to the same issue?

Thanks

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.