Trusted Contributor.. Trusted Contributor..
Trusted Contributor..
197 views

connector shutdown question

I found that connecoter would shut down and up at fixed times

connecter type is Microsoft Windows Event Log – Unified.

I don’t understand why he has regular actions. Is there any relevant setting to confirm?

thanks

mary

4 Replies
Highlighted
Micro Focus Expert
Micro Focus Expert

Re: connector shutdown question

Hello Mary,

Does the connector go up and down by itself or you have to start it yourself?
What is the connector version?
If you check agent.log files, do you see any specific ERROR or FATAL messages at the time the connector restarts?
Did you notice any issues with the memory or performance? What is the EPS count?
I would definitely start from the logs as it might tell you why this is happening.

Regards,
Kresimir

Highlighted
Trusted Contributor.. Trusted Contributor..
Trusted Contributor..

Re: connector shutdown question

Hi Kresimir:

Thank you for your response, I reply as follows.

Does the connector go up and down by itself or you have to start it yourself?  A: I did not launch the connector.
What is the connector version? A: 7.6.0.8009.0

If you check agent.log files, do you see any specific ERROR or FATAL messages at the time the connector restarts? A: The log content is as follows, but I don't see what causes the shutdown. 

27 11:59:53,150][INFO ][default.com.arcsight.agent.util.q$b][rateLimitedCheckStatusLine] WUC:WUC[IKiSF3EBABCAD7AG0Dpicg==](1)->|179|0:E|172|0:E|163|0:E|187|0:E|177|0:E|159|0:E|203|0:E|168|0:E|188|0:E|165|0:E|213|0:E|171|0:E|209|0:E|157|0:E|168|0:E|177|0:E|179|0:E|193|0:E|207|0:E|168|0:E|263|0:E|172|0:E|157|0:E|189|0:E|156|0:E|162|0:E|165|0:E|190|0:E|161|0:E|196|0:E|164|0:E|
[2020-03-27 11:59:57,048][WARN ][default.com.arcsight.event.SecurityEvent][setModelConfidence] Number of bad threat level values received and corrected = 19990
[2020-03-27 12:00:00,747][INFO ][default.com.arcsight.agent.util.q$b][rateLimitedCheckStatusLine] WUC:WUC[WUC[XaSSF3EBABCADLAG0Dpicg==](1)][xxxxxxx][Application]->|90|1:13|88|1:11|93|1:12|108|1:19|116|1:22|93|1:12|103|1:18|98|1:17|103|1:16|94|1:12|93|1:14|103|1:20|130|1:20|105|1:18|109|1:14|96|1:15|97|1:14|95|1:14|97|1:14|97|1:18|94|1:13|103|1:14|113|1:24|131|1:25|111|1:23|109|1:14|119|1:18|97|1:16|99|1:17|102|1:18|108|1:20|
[2020-03-27 12:00:00,759][INFO ][default.com.arcsight.agent.util.q$b][rateLimitedCheckStatusLine] WUC:WUC[WUC[XaSSF3EBABCADLAG0Dpicg==](1)][XXXXXXX][System]->|91|1:12|91|1:15|91|1:13|115|1:20|108|1:12|94|1:13|102|1:12|104|1:18|100|1:15|93|1:14|91|1:12|111|1:20|125|1:15|114|1:24|99|1:14|99|1:17|95|1:15|94|1:14|96|1:13|100|1:16|94|1:16|100|1:13|123|1:23|133|1:25|103|1:17|108|1:16|117|1:14|98|1:15|99|1:15|103|1:16|104|1:12|
[2020-03-27 12:00:01,965][INFO ][default.com.arcsight.agent.Agent][shutDown] Shutting Down Agent Framework Version [7.6.0.8009.0]
[2020-03-27 12:00:01,977][INFO ][default.com.arcsight.agent.f.c][stopEventCollection] Attempting to stop event collection
[2020-03-27 12:00:01,977][INFO ][default.com.arcsight.agent.f.c][stopEventCollection] No need to stop event collection because MQ Server is not running
[2020-03-27 12:00:01,978][INFO ][default.com.arcsight.agent.fr][run] Interrupted, possible shutdown
[2020-03-27 12:00:01,979][INFO ][default.com.arcsight.agent.fk][run] Terminated


Did you notice any issues with the memory or performance? What is the EPS count? A:Confirmation of performance. EPS count is 29.6 E/s(avg).

thanks 

mary

Highlighted
Micro Focus Expert
Micro Focus Expert

Re: connector shutdown question

Hi Mary,

 

Well, I don't see anything odd which would tell why this is happening.
Information you have posted is not enough to say what could cause this issue.

As a first step, I would definitely recommend installing the latest version 7.14.
7.6 is really old and many issues have been fixed in the most recent version.

If the issue would still happen after that, I'd recommend opening a support ticket providing current/user/agent and current/logs and explain your issue (you can also link this post).

Regards,
Kresimir

Highlighted
Trusted Contributor.. Trusted Contributor..
Trusted Contributor..

Re: connector shutdown question

ok.Let me observe.

 
thanks
 
mary
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.