Massive java.lang.IndexOutofBounds Errors with rules. Please help.

[nmbabkin1]

Today I updated my ESM from 5.2 patch 2 to 5.5, and also Oracle instance to 11.0.2.3.

  There were no errors during updating so far, all was extremely good. However, when i started manager and tried to edit some rules, error window appeared:

  Could not create editor: java.lang.ArrayIndexOutOfBoundsException: -1

  This happens for almost half of my rules, and the result is that i can not edit them!

  Please help, cause it's a critical problem for us.

See errorScreen.png for details.

vbcvbceerwe

Today I updated my ESM from 5.2 patch 2 to 5.5, and also Oracle instance to 11.0.2.3.

  There were no errors during updating so far, all was extremely good. However, when i started manager and tried to edit some rules, error window appeared:

  Could not create editor: java.lang.ArrayIndexOutOfBoundsException: -1

  This happens for almost half of my resources, and the result is that i can not edit them!

  Please help, cause it's a critical problem for us.

S

[wsladek1]

Try having the manager rebuild all the rules:

stop the manager

cd $MANAGER_HOME/

mv rules rules.`date +%m%d%y`

mkdir -p rules/{checkpoint,classes,Temp}

start the manager

[nmbabkin1]

wsladek,

thanks for the tip. I did as you advised, but that didn't help.

Still same issues. Any other suggestions?

[nmbabkin1]

Hello, guys!

I just realized: that happens only when i try to create/modify LightWeight or Pre-Persistence Rule.

All standart rules are clearly OK. I can create and modify them.

Any suggestions?
Thanks!

[nmbabkin1 · Accepted solution]

Hello again!
Fortunately, it was a Console bug.

I realized it when i tried the same thing on another host, and I was like o_0 seeing that I could create/modify any rule.

So, what I did in my case after that:

1) Uninstalled all other consoles (5.0, 5.2, 6.0 were already installed on my PC for testing purposes)

2) Reinstalled actual 5.5 Console

3) Rebooted PC

Now the bug is gone, I would like to thank all who participated.

Moderators can now close the topic.

HeH

H

[nikolei.steinha]

Hi,

to solve the issue remove the content in the directory ".arcsight" in the home directory of your user.

Kind Regards

Nikolei

[reswob4]

Is that for when you install the console on Linux?  In Windows it's a different location... I believe it's under %ARCSIGHT HOME%/Console/current, but I'm not sure which of the many files there would be good to delete...

The reinstall solution does not work for me... or I should say it only works temporarily.  The error keeps returning.

[nmbabkin1]

Hey, I already found an another solution.
Just delete the .ast file in Console\current directory and then restart the console. The issue will be gone.

[reswob4]

That worked even better!

Thanks.

[paulnip1]

In my case, I'm having the same issue on lightweight rule (mostly) from the 6.5 Sp1 console. The console was installed on a Windows 7 machine, what I had found out is that if I close the console and go to the directory where the console is installed; in my case, C:\arcsight\console\current\, and delete or rename the file "username.ast" (where username is your login ID for the console, then restart the console again and java error will be gone. What seems to me that this file is caching the last session of the user. When this file is deleted, after you logon you will be presented with the default tabs opened instead of whatever you had previously left when the console is closed. Hope this help.

[paulnip1]

Haha, you beat me to it Nikolay!   I had found the same solution!