UPDATE! The community will be go into read-only on April 19, 8am Pacific in preparation for migration on April 21. Read more.
UPDATE! The community will be go into read-only on April 19, 8am Pacific in preparation for migration on April 21.Read more.
Ensign Ensign
Ensign
352 views

Upgrade ESM from 6.9.1.c to 6.11

We are upgrading the ESM from 6.9.1c to 6.11.

We encountered issue when try to run ./stop_services.sh as root in ArcSightESMSuite-6.11.0.2149.0.tar /Tools folder. The message just showing "stopping services." and hang there.

We discover we can't use root user to run /etc/init.d/arcsight_services status / stop /start.

It will prompt for password when executing /etc/init.d/arcsight_services, we enter with "arcsight" user password and it pass through and no responding afterwards.

If we are using user "arcsight" to run /etc/init.d/arcsight_services status / stop /start, we don't have any issues at all.

Any idea what might causing this issue?

 

0 Likes
5 Replies
Micro Focus Frequent Contributor
Micro Focus Frequent Contributor

Hi,
Did you tried to use "su -" instead "su"?
Included log-file contains following error:
ERROR: The current ESM version () cannot be upgraded to 6.11.0.
So, it may be environment issue
0 Likes
Ensign Ensign
Ensign

Hi,

We tried with su - but no luck it's still the same.

ERROR: The current ESM version () cannot be upgraded to 6.11.0.

When we run the ./stop_services as root user, it will prompt for password.

This ERROR will show if we enter wrong password for "arcsight" user.

 

 

 

0 Likes
Ensign Ensign
Ensign

Hi 

 

We finally found the issue. The reason is because the user RHEL environment not allow root su to arcsight without password.

https://www.tecmint.com/switch-user-account-without-password/

we follow the above article to change the settings and allow root su to arcsight without enter any password. Now everything are working fine!

Thanks

Micro Focus Frequent Contributor
Micro Focus Frequent Contributor

Awesome, thanks for sharing.

0 Likes
Micro Focus Frequent Contributor
Micro Focus Frequent Contributor

Hi @mxn 

 

If you're trying to stop arcsight as root, try to instead run (as root)

/sbin/service arcsight_services stop all

this will stop the arcsight ESM as the user arcsight.

If this is not working, you may need to make sure you've installed the services for ESM correctly, you can quite easily remove and re-install the arcsight services using the supplied scripts as per the documentation (running as root)

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.