Highlighted
Absent Member.
Absent Member.
1002 views

Resetting ArcSight Express to Factory Default. Prerequisites?

Jump to solution

Greetings All.

Our situation – We have an ArcSight Express box - V7400m appliance. Some tenderfoot trials on the box have left it with messed up interface configurations and component services. Troubleshooting is not earning any solutions. So we have planned to factory reset the appliance.

Our Question - What are the things need to taken care of while resetting it to factory default? Any backups to be taken before resetting?

*Note - We haven’t integrated any log sources to ESM yet. its just an appliance with messed up configurations!

Labels (3)
0 Likes
1 Solution

Accepted Solutions
Highlighted
Absent Member.
Absent Member.

Hi Abraham,

It sounds pretty much the same as I went through.

Let me describe this in two ways. first if your console is up and running you can take the backup of resources though the console itself in the form of .arb this can possibly be the rules, filters, active channels, users, dashboards... this arb can be used once after the system is up and you can push back the arb into the system through the console.

the other case is like you said this is a new one, and has no configuration then you can go ahead with resetting it into factory settings. With a few information in hand, like the license file which is required once the system boots up after the OS is set.

You may find the doc from where you can start with the  section "Restoring Factory Settings" at page 71-78 then allow the system to boot and start the AE configuration from the section "Configuring ArcSight Express Appliance" from page # 17-36

Hope this helps All the best

Regards,

Mansoor Ilahi

View solution in original post

0 Likes
6 Replies
Highlighted
Acclaimed Contributor.
Acclaimed Contributor.

You need backup system tables, archives, config files.

0 Likes
Highlighted
Absent Member.
Absent Member.

Thanks for your reply. We don’t have any event data. So I believe the archives and system tables would be empty.

Please correct me if I’m wrong.

Thanks

Abraham I J

0 Likes
Highlighted
Acclaimed Contributor.
Acclaimed Contributor.

In system tables not only archives: users, rules, report and other content.

If you not have custom content - nothing can be copied

0 Likes
Highlighted
Absent Member.
Absent Member.

Exactly! We haven't created any resource in Arcsight. Its as new as a shipped box, but with wrong initial configuration.

Can we go ahead with reset, with backup of license file and config files?

Thanks

Abraham I J

0 Likes
Highlighted
Absent Member.
Absent Member.

Hi Abraham,

It sounds pretty much the same as I went through.

Let me describe this in two ways. first if your console is up and running you can take the backup of resources though the console itself in the form of .arb this can possibly be the rules, filters, active channels, users, dashboards... this arb can be used once after the system is up and you can push back the arb into the system through the console.

the other case is like you said this is a new one, and has no configuration then you can go ahead with resetting it into factory settings. With a few information in hand, like the license file which is required once the system boots up after the OS is set.

You may find the doc from where you can start with the  section "Restoring Factory Settings" at page 71-78 then allow the system to boot and start the AE configuration from the section "Configuring ArcSight Express Appliance" from page # 17-36

Hope this helps All the best

Regards,

Mansoor Ilahi

View solution in original post

0 Likes
Highlighted
Absent Member.
Absent Member.

Definitely it helped!! Thank you.

Thanks

Abraham I J

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.