Report Performance Issues
I try to consolidate in this discussion all the Reports Performance Issues I have faced with ArcSight Express, so we can share ideas and solutions
First of all, open the "Reporting Subsystem Statistics" dashboard under "/All Dashboards/Arcsight Administration/ESM/System Health/Resources/Reporting". This is a very helpful dashboard to spot whether the report stuck in the QueringDB or Rendering stage.
After that check your issue against below scenarios/symptoms:
1) Running reports on long time periods:
- This reports stuck in the QueringDB stage due to the huge amount of records inside the database
- In that case you will see below error in server.log (could be server.log.1 or server.log.2, etc ...so the best thing is to grep through server.log*):
Report could not be archived.
Reason: inetsoft.sree.RepletException: Failed to create report: com.arcsight.server.reports.ReportGenerationException: Encountered persistence problem while fetching data: Unable to execute query: Temporary sort space limit exceeded
- Definitive solution is to increase the sort_temp_limit parameter, check the following for more details
- ESM_AdminGuide_6.8c.pdf -> page 145
- Optimum solution is to use trends or refine the query filters to reduce the amount of records being queried in the database.
2) Using heavy string manipulation variables inside the query feeding the report
This causes the QueringDB process to last for more than 10 hours so it got interrupted by an ArcSight self-safe mechanism with below error (solution is to remove these report killer variables from your query):
Failure during execution attempt: inetsoft.sree.RepletException: Failed to create report: com.arcsight.server.reports.ReportGenerationException: Encountered persistence problem while fetching data: Unable to execute query: Query execution was interrupted. [Thread = Thread-2126]
3) Report stuck in rendering stage and never ends
- Noticed with firewall configuration changes reports
- Reason still unknown but I expect due to the output returned by it, so may be bug in the output (rendering procedures when dealing with this kind of device configuration results)
- When there is no configuration changes happen, the reports produce successfully
- Still under HP backline investigation
Hint: The second and third scenario/symtomp are conclusions of mine any may not be 100% accurate so feel free to comment and correct me if i am wrong. But at least for the second one i managed to make a report of 4 queries to succeed after it was failing before in the 2nd query due to the heavily string manipulation variables that i were using inside that query (just removed the variables and it produced perfectly in 10 minutes instead of 10 hours and then timeout).
Mannai Trading Company