Highlighted
ifi Trusted Contributor.
Trusted Contributor.
431 views

CIFS sharing in use

Hi,

on my logger appliance I configured a CIFS sharing that points to a Windows Server 2008 R2.

The sharing seems to be ok, since I didn't receive errors. But I can't configure/delete it anymore, since it's always marked as "In Use". Even if it isn't, or, at least, I think it's not.

As anyone experienced an issue like this?

Thank you in advance

Labels (1)
0 Likes
Reply
8 Replies
Honored Contributor.. Richie D Honored Contributor..
Honored Contributor..

Re: CIFS sharing in use

Yes, this is normal behaviour

You can only edit the CIFS share details when the share is not "in-use" - from experience, you can edit the share immediately after a logger reboot before the share gets grabbed and used by the logger application.

0 Likes
Reply
ifi Trusted Contributor.
Trusted Contributor.

Re: CIFS sharing in use

Thanks Richard.

I also scheduled a search to save results on that shared folder, but no data is being saved, even if the query has run. Can you help me troubleshooting this issue? Which logs may I look at to find which errors are happening?

0 Likes
Reply
Honored Contributor.. Richie D Honored Contributor..
Honored Contributor..

Re: CIFS sharing in use

AFAIK, the "Remote File Systems" (shares) can only used for Event Archives.

Simply using "Event Archives" as a search should give you an idea as to when and what is being written.

Or if you could search for logger events in deviceEventClassId:

logger:525 (Event Archive Archived OK)

logger:528 (Event Archive Failed)

Does this help?

0 Likes
Reply
Frequent Contributor.. mjleininger_158171 Frequent Contributor..
Frequent Contributor..

Re: CIFS sharing in use

Stop the connector(s) which use the mounted filesystem.  ensure that they stay stopped.  Ours seem to start back up periodically so there's probably some kind of overseeing process which tries to restart them if they stop.

(I stop them with "/etc/init.d/arc_appliance_connector_2 stop")

Dismount the filesystems using the umount command.  ArcSight will think the mount is in use as long is it remains mounted.

Now you should be able to edit it. 

When you're done, start the connector(s) with "/etc/init.d/arc_appliance_connector_2 start" (it will automatically remount the filesystem since is's auto-mounted)

I think that's what you wanted ....

0 Likes
Reply
ifi Trusted Contributor.
Trusted Contributor.

Re: CIFS sharing in use

Thank you Marvin,

I can not access to logger appliance right now, but I'll try your suggestion as soon as possible.

Federico

0 Likes
Reply
ifi Trusted Contributor.
Trusted Contributor.

Re: CIFS sharing in use

Hi Marvin,

I'd like to try your suggestion, but there are 2 issues:

1) Since I use physical appliance (build by HP), I cannot access to the Linux CLI

2) Currently there is no connector using the share I created, but the seem to be in use.

Isn't there a way to perform the actions you suggested, via web GUI? I attach a screenshot of the share situation I'm facing with. As you can see all of them are in "in use" state, so I cannot edit them.

Thank you again,

Federico

share.PNG

0 Likes
Reply
Frequent Contributor.. mjleininger_158171 Frequent Contributor..
Frequent Contributor..

Re: CIFS sharing in use

Some things can be done from the ArcSight GUI, but I don't know of any way to unmount the filesystem and yet keep the configuration (I haven't looked for a way, so there might be).  What I said is how I actually do it on our system.  You have to stop the connector or you can't unmount th efilesystem.  The ArcSight appliance will think the filesystem is in use as long as it is mounted, whether or not the connector is running.  If you want another way you could ask HP support - that is just how I am doing it on our system. 

I suppose that you could totally remove and recreate the filesystem mount in Arcsight, rather than trying to edit it.  I don't know why that wouldn't work, but be sure to document your configuration before removing it.  Editing is just easier.  You would still likely have to either stop any connectors which use the mount, or change their configuration so that they don't use the mount.

0 Likes
Reply
Micro Focus Expert
Micro Focus Expert

Re: CIFS sharing in use

This is how it worked for me:

  1. Login as root via SSH on the Appliance
  2. list all mount points with
    # mount
  3. remove desired mount point with
    # umount /opt/mnt/<mountpoint>
  4. Go to GUI and verify that mountpoint is not in use anymore.
    Now the RFS can be deleted

Hope that helps

Tobias

The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.