Highlighted
Absent Member.
Absent Member.
1458 views

New Issue with ESM 6.8 Patch2

There is an issue in a new Patch when Active List when new entries in some active lists are not being populated.
Also it seems like purging Engine suddenly stops after a while.

For example today it happened at 05:46 AM, when purging engine suddenly stopped and ALs got overloaded. The last log with "Purged AL" keyword appeared:

[2015-11-20 05:46:02,468][INFO ][default.com.arcsight.common.activelist.DefaultActiveListCache] Purged AL System - Resource ChangeLog removing 0 entries in 116 msec, new size = 390189

After that all the "Purged AL" logs has dissapeared.

Is anyone experiencing this?



UPDATE: Also have a look at screenshots that I've just taken. Looks kinda funny when playing with TTL. Clearly a bug.


beforeTTLchanged.jpg

afterTTLchanged.jpg



Labels (1)
0 Likes
17 Replies
Highlighted
Absent Member.
Absent Member.

After some analyzis and searching on Protect, I've found that issue is looking exactly like this:

0 Likes
Highlighted
Acclaimed Contributor.
Acclaimed Contributor.

Hi Nikolay,

Since we consider the issue you refer to as solved in 6.8c, it is interesting (and naturally disturbing) that you have identified it in 6.8c P2. It would be valuable if you report the issue to support. Feel free to pass me the ticket number so I can accelerate in the backend.

Thanks

~ Ofer

0 Likes
Highlighted
Absent Member.
Absent Member.

Hi Olef, and thanks for the answer!

Service Request ID is 4652879348

Please proceed with this.

0 Likes
Highlighted
Absent Member.
Absent Member.

2015-11-23_10-11-45.jpg

OK, here's an update. We also have this type of error everytime we are logging on to a console. I see this for the second time since Patch2 Install. Maybe there is a relation to the bug.

There was an error while logging into core services of type: class java.io.IOException.

Please consult log files to diagnose the issue.

Login will still continue, but some services may be affected.

0 Likes
Highlighted
Absent Member.
Absent Member.

Hello!

Any updates? We have to reboot ESM every 2 days to get rid of it.

It is a very awful situation

0 Likes
Highlighted
Honored Contributor.. Honored Contributor..
Honored Contributor..

We were the ones who reported the issue initially and havent seen it on 6.8cP2.  My guess though is that support\dev is going to tell you the number of entries in your AL cache (in memory) is too high.  The screenshot you had showed a capacity of 5 million entries and the log message was for 390,000 entries which I can tell you that support is going to probably tell you is too big (may not actually be the issue but they may have you try and reduce those first).  Hopefully they can figure it out, otherwise you may have to cronjob a manager restart (we had to do that last time we had similar issues until we could fix it).

0 Likes
Highlighted
Absent Member.
Absent Member.

Hey Guys.
I think we were able to resolve this issue with HP Support by rebuilding AL cache:

/etc/init.d/arcsight_services stop manager

mv /opt/arcsight/manager/tmp/tuple/local/classes/ /opt/arcsight/manager/tmp/tuple/local/classes_old

mv /opt/arcsight/manager/tmp/tuple/local/source/ /opt/arcsight/manager/tmp/tuple/local/source_old

/etc/init.d/arcsight_services start manager



Since then we haven't experienced this issue for a week already.
Will have a look further and post additional information later.

0 Likes
Highlighted
Honored Contributor.. Honored Contributor..
Honored Contributor..

I think this is unrelated.

see https://protect724.hp.com/message/62718

0 Likes
Highlighted
Absent Member.
Absent Member.

I'm seeing the same issue.  Rebuilding the AL cache only solved the issue temporarily.

- Brandon

0 Likes
Highlighted
Absent Member.
Absent Member.

Hey Guys.
Thats why i don't mark it as a correct answer. Lets wait for HP to solve this completely.

0 Likes
Highlighted
Absent Member.
Absent Member.

Unfortunately we just catched this issue again after 2 weeks of stable work.

Will send the new thread dumps to HP Support.

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.