Highlighted
Respected Contributor.
Respected Contributor.
457 views

What is "Writer not initialized" error from a smartconnector

Spoiler

We have a connector that works for a few minutes and then produces the following error and stops working

 

[2017-10-10 17:08:58,877][FATAL][default.com.arcsight.agent.loadable._M1Processor][sendToCache] 

  1. com.arcsight.agent.bc.f: Writer not initialized.

 at com.arcsight.agent.bc.j.b(j.java:520)

 at com.arcsight.agent.d3.a.b(a.java:366)

 at com.arcsight.agent.d3.a.b(a.java:349)

 at com.arcsight.agent.d3.d.run(d.java:81)

 

Any thoughts?

Labels (1)
0 Likes
5 Replies
Highlighted
Acclaimed Contributor.. Acclaimed Contributor..
Acclaimed Contributor..

If I had to guess a disk space or permissions issue.  Check the permissions on the following directory:

<ArcSightSmartConnector>/current/user/agent/agentdata

0 Likes
Highlighted
Honored Contributor.
Honored Contributor.

Have you ever found a solution for this?

 

We've also identified this issue in 2 agent out of 200, but no idea how to solve it, it's persistent. We have the appropiate permissions on the agent dir.

Support just don't provide any help, so we're stuck.

 

Any hints are appreciated. 

 

Regards,

 

Karl.

0 Likes
Highlighted
Acclaimed Contributor.
Acclaimed Contributor.

Hi,

When a SmartConnector writes to cache, it is possible that the communication to ESM or Logger destinations where not available for different reasons.

Network issue, ESM down, etc...

Do you have other info in the agent.log that could help?
Did you try to make a telnet to ESM to see if the connector has still access to communicate to ESM?
What is the value EPS/Event Count in the Connector Status Dashboard of ESM?

Thanks
Regards

Michael

0 Likes
Highlighted
Honored Contributor.
Honored Contributor.

Hi,

 

Thanks for the inputs shared, 

However, those ones doesn't explain the issue shown here:

 

There's no error with the destination: esm is up and running.

The agent is able to connect to the esm, the telnet to esm_host:8443 is success.

The error here is that there's a large cache on the agent which is never processed and the only errors seen are the 

 

[2020-08-10 12:13:53,985][FATAL][default.com.arcsight.agent.loadable._AgentCacheProcessor][onSingleEvent]
com.arcsight.agent.dv.b: Writer not initialized.
at com.arcsight.agent.dv.f.a(f.java:521)
at com.arcsight.agent.cf.j.onSingleEvent(j.java:174)
at com.arcsight.common.flow.stock.g.safeNotify(g.java:38)
at com.arcsight.agent.flow.b.safeNotify(b.java:88)
at com.arcsight.common.flow.h.a(h.java:162)
at com.arcsight.common.flow.stock.h.c(h.java:37)
at com.arcsight.common.flow.i.b(i.java:129)
at com.arcsight.agent.fd.onSingleEvent(fd.java:269)
at com.arcsight.agent.cf.c.f.onSingleEvent(f.java:96)
at com.arcsight.agent.cf.c.g.onSingleEvent(g.java:42)
at com.arcsight.common.flow.stock.g.safeNotify(g.java:38)
at com.arcsight.agent.flow.b.safeNotify(b.java:88)
at com.arcsight.common.flow.h.a(h.java:162)
at com.arcsight.common.flow.stock.h.c(h.java:37)
at com.arcsight.common.flow.i.b(i.java:129)
at com.arcsight.agent.cf.d.a.a(a.java:73)
at com.arcsight.agent.cf.d.a.onSingleEvent(a.java:44)
at com.arcsight.agent.cf.d.d.onSingleEvent(d.java:38)
at com.arcsight.common.flow.stock.g.safeNotify(g.java:38)
at com.arcsight.agent.flow.b.safeNotify(b.java:88)
at com.arcsight.common.flow.h.a(h.java:162)
at com.arcsight.common.flow.stock.h.c(h.java:37)
at com.arcsight.common.flow.i.b(i.java:129)
at com.arcsight.agent.cf.h.a.onSingleEvent(a.java:39)
at com.arcsight.common.flow.stock.g.safeNotify(g.java:38)
at com.arcsight.agent.flow.b.safeNotify(b.java:88)
at com.arcsight.common.flow.h.a(h.java:162)
at com.arcsight.common.flow.stock.h.c(h.java:37)
at com.arcsight.common.flow.i.b(i.java:129)
at com.arcsight.agent.transport.b.r.b(r.java:194)
at com.arcsight.agent.transport.ab.a(ab.java:589)
at com.arcsight.agent.transport.o.e(o.java:185)
at com.arcsight.agent.transport.o.run(o.java:110)

 

From what I can see it's actually an agent issue with cache processing .. but no idea how to solve it.

Note that this translates into a heavy caching scenario with eventual event dropping ..

 

BTW, Support Team has not provided any valuable help after weeks of escalation, as usual there's lack of RCA.

 

Regards,

 

Karl.

0 Likes
Highlighted
Honored Contributor.
Honored Contributor.

Hi All,

Did somebody found the root cause behind this issue?

We have no answer from support team and there's no apparent reason for this issue.

BR

Karl.

The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.