Highlighted
Captain
Captain
1066 views

"Not Enough Disk Space" error on Installation Logger 6.7.1

Jump to solution

I have a problem when installing the software ArcSight Logger 6.7.1. The installation path is a typical path of /opt/arcsight and that exists on a 14 TB LUN in a VM running the latest version of ESXi. Any user who has permission can write files to the LUN and delete them all they want manually well in excess of 10 GB. In fact this LUN was running a Logger until the latest Red Hat update to RHEL 7.7. At this point the Logger stopped working and I attempted to upgrade it from 6.4.0 to 6.4.1. and that failed partially, it installed the software but would not start the services. I upgraded again to 6.5.0 and that mostly worked, but I lost web page functionality and any GUI access and in short nothing seemed to be working and the wrong ports were up (Also, could not install under root had to use non-root user arcsight, but root was what was used in the previous installation), but the services were all running. I needed to get this upgraded to the latest version of Logger and there is no upgrade path that allows this to start below 6.7.0. so this has to be a fresh installation according to the Release Notes. The error I keep getting when installing into this clean directory as root or non-root user is "Not Enough Disk Space" It shows only 3.964 GB available. Clearly, there is nothing taking up the space (Yes, I did a df -h), I have checked that very closely. Nothing hidden, so the installer is not seeing the disk space. This is an installation incompatibility I have a Service ticket opened on it, but after 3 weeks there seems to be no solution. I wondered if anyone else has seen this error? 

0 Likes
1 Solution

Accepted Solutions
Highlighted
Captain
Captain

I guess no one else saw my reply, it's really very simple, rolling back to RHEL 7.6 is NOT an option. This is a very secure facility and they don't allow rollbacks of the OS. Also, I gave the fix for the DISK space, and the real answer is this. It cannot be installed on RHEL 7.7 as the root user. Maybe on a non-hardened version of the OS but not the STIG level of hardening.

View solution in original post

9 Replies
Highlighted
Lieutenant Lieutenant
Lieutenant

Hello,

We have also faced the same issue, we have to downgrade os version from RHEL 7.7 to 7.6 and the problem is solved.

 

Regards.

 

Highlighted
Captain
Captain

Thanks for that reply, but backing down an OS is not allowed in our environment, so that is not really a solution for us and is a step backwards for anyone. We are engaging higher levels at Micro Focus to figure out a way to get this work on RHEL 7.7 since that and the related hardening are causing many other issues now as well. (It will install on an unhardened version but that is also not allowed in our environment. The other work around to this error was to make environment changes to get passed this error but later in the installation we run into segmentation faults is this command: export CHECK_DISK_SPACE=OFF

Highlighted
Lieutenant Lieutenant
Lieutenant

You are absolutely right. Most of the other SIEM products only need A linux to work, but on arcsight it should be very specific. I wish arcsight has more compatibility among other linux operating systems.

0 Likes
Highlighted
Admiral
Admiral

Well, to be fair Logger 6.7.1 was released in April 2019 with RHEL 7.6 support - most current for that timeframe. RHEL 7.7 was released later (in August 2019).

Logger is getting more and more backward OS tolerant (v6.7.1 still supports RHEL 6.8) but it cannot predict future changes Red Hat performs on next versions.

-Tobias

Highlighted
Micro Focus Expert
Micro Focus Expert

If the OS version really is the problem I would recommend to install with the supported version of RHEL 7.6. You can upgrade at a later point once it is supported

0 Likes
Highlighted
Captain
Captain

I guess no one else saw my reply, it's really very simple, rolling back to RHEL 7.6 is NOT an option. This is a very secure facility and they don't allow rollbacks of the OS. Also, I gave the fix for the DISK space, and the real answer is this. It cannot be installed on RHEL 7.7 as the root user. Maybe on a non-hardened version of the OS but not the STIG level of hardening.

View solution in original post

Highlighted
Cadet 1st Class
Cadet 1st Class

Hmm.. 

We are running Logger 6.7.1 under RHEL 7.7 (installed as root) and with the DISA STIG applied with no issues.. HOWEVER, we did indeed get the "Not enough Disk space" issue on installation until we increased the root partiton size.

If you read the release notes/intallation guide, you'll spot the disk space requirements which states 40Gb in the ROOT partition.. in addition to a minimum of 65Gb in the logger installation directory.

In practive though, we have found that logger will install as long as you have at least 15Gb spare on the root partition - this also assumes that you have sensibly moved folders normally found within the root partition into their own partitions, i.e. ./var, /home

Perhaps someone at MicroFocus could explain exactly why there is a such a disk space requirement on the ROOT partition?

 

Highlighted
Captain
Captain

Okay, the forum deleted my last comment. I will try again.

Yes, your comment is spot on. It seems I missed that requirement part. I did read it several times but at this point my focus was on the error of "Not Enough Disk Space" which seems to be an erroneous error. See below:

This installation requires 10,573.53 MB of free disk space, but there are only
3,964.27 MB available at:

/opt/arcsight

Please free at least 6,609.26 MB to proceed with the installation.

That space requirement was met, but that is EXACTLY the size that was available on the root partition or /

No wonder I was chasing the wrong rabbit down the wrong hole. Thank you for spotting that!!!

 

0 Likes
Highlighted
Captain
Captain

This also probably explains the segmentation faults that happen if you just bypass the error. GRRRRRR! All because the error points to /opt/arcsight and because I missed a critical installation point. I have to wonder if there is an installation switch that would allow everything to be done inside the actual installation directory of /opt/arcsight? There should be no reason to be forced to size up to 40 GB or as the error says 10 GB free for the installation. I have issues with that requirement.

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.