Problem importing Zones
I am creating my network model using the tool "Resources Generator" in the Manager version 18.104.22.16826, but so far without succeeding. First of all I imported my locations (8000 approximately), and everything was perfect. Now I am trying to do the same with the zones and I do not why it takes a long long time. Concretely, I am trying to import 1000 zones, but the operation takes 55 minutes more or less. If a try to import more than 1000, for example 5000, there is a moment that the connection with the manager fails (as you can see in the enclosed file), so finally I do not have any zone in my manager. Can anybody help me?I
Thank you very much in advance.
Thank you Christian,
I had checked the Wizard before, but my problem is that I have too many locations, so the association is complicated.
This pretty much looks like a kind of out-of-memory condition during the import.
Does it work with a smaller import file? Then that's most probably the problem.
Are you doing this a single time or regularly? If it is a single time, then just split the import file to make the XML file smaller.
If that is not an option you may need to tweak the memory of the server.
There may may a knowledge base article for this.
Let me know if that helps, Till
Finally I solved the problem: all I did is to import the zones into a folder with a different name and the performance was really better (do not know why). Now that the network model is created, we are facing a new problem, to update the categories of our assets: I have tried it modifying my.csv file and passing it again to the "assets import connector", but without succeeding. This problem consists in:
>> If I delete one category in the .csv file, in the database does not happen the same.
>> If I modify one category, another category is created instead of modifying it.
I hope somebody can help me. Thanks in advance.
BR, Christian Paape.
Are you using the resource Generator or the asset import connector?
ResourceGen does not support removing categories. It was purely designed for initial import and not for regular updates.
Not sure about the asset import connector.
You would essentially need to make a diff and then generate an XML which explicitly removes that category.
Thanks for answering,
to import the assets I use the "Assets Import Connector". About the way you propose, I think we should know first which categories we want to delete. This is not interesting for me, because all that I have is a new .csv file containing all the assets and I do not know which ones have been modified and in which categories.
Thanks in advance. Yours faithfully, Christian Paape.
I also got the same problem.
What's best practice to import:
to Arcsight continuous?
We would like to import a acutal CSV file which is update by the Network-Team and import it into Arcsight. Then all the new stuff should be imported / created and things which aren't in this CSV anymore should be removed at this point.
I'm sure, some people working in big, big ArcSight ESM environments have also made up their minds about this problem and hopefully found a solution (to tell me).
I would be very, very interessted to hear some different approaches.
- Thanks in Advance, Silvan
One thing you can try is to import an xml with these resources. What you should do is create a package with some zones, assets, networks, etc. Export it, open the arb (its a zip file) and extract the xml. The request your network team to create their file in that format, or you can do it yourself based on their csv.
Then import the xml with the command arcsight archive -i -m <manager> -u <user> -p <password> -f yourFile.xml
I'm not sure how the manager will handle such huge files (depends on the version) so try it first in a dev environment.