Highlighted
Super Contributor.. hatemware Super Contributor..
Super Contributor..
1004 views

Report Performance Issues

Hi All

I try to consolidate in this discussion all the Reports Performance Issues I have faced with ArcSight Express, so we can share ideas and solutions

First of all, open the "Reporting Subsystem Statistics" dashboard under "/All Dashboards/Arcsight Administration/ESM/System Health/Resources/Reporting". This is a very helpful dashboard to spot whether the report stuck in the QueringDB or Rendering stage.


After that check your issue against below scenarios/symptoms:

1) Running reports on long time periods:

  - This reports stuck in the QueringDB stage due to the huge amount of records inside the database

  - In that case you will see below error in server.log (could be server.log.1 or server.log.2, etc ...so the best thing is to grep through server.log*):

Report could not be archived.
Reason: inetsoft.sree.RepletException: Failed to create report: com.arcsight.server.reports.ReportGenerationException: Encountered persistence problem while fetching data: Unable to execute query: Temporary sort space limit exceeded

  - Definitive solution is to increase the sort_temp_limit parameter, check the following for more details

- Optimum solution is to use trends or refine the query filters to reduce the amount of records being queried in the database.

2) Using heavy string manipulation variables inside the query feeding the report

This causes the QueringDB process to last for more than 10 hours so it got interrupted by an ArcSight self-safe mechanism with below error (solution is to remove these report killer variables from your query):

Failure during execution attempt: inetsoft.sree.RepletException: Failed to create report: com.arcsight.server.reports.ReportGenerationException: Encountered persistence problem while fetching data: Unable to execute query: Query execution was interrupted. [Thread = Thread-2126]

3) Report stuck in rendering stage and never ends

- Noticed with firewall configuration changes reports

- Reason still unknown but I expect due to the output returned by it, so may be bug in the output (rendering procedures when dealing with this kind of device configuration results)

- When there is no configuration changes happen, the reports produce successfully

- Still under HP backline investigation

Hint: The second and third scenario/symtomp are conclusions of mine any may not be 100% accurate so feel free to comment and correct me if i am wrong. But at least for the second one i managed to make a report of 4 queries to succeed after it was failing before in the 2nd query due to the heavily string manipulation variables that i were using inside that query (just removed the variables and it produced perfectly in 10 minutes instead of 10 hours and then timeout).

BR,

Hatem Metwally

Security Consultant

Mannai Trading Company

Labels (2)
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.