Welcome Serena Central users! CLICK HERE
The migration of the Serena Central community is currently underway. Be sure to read THIS MESSAGE to get your new login set up to access your account.
dlamonte1 Absent Member.
Absent Member.
365 views

Duplicate records, file process continuously looping

Our ISA connector previously would process our remote logs and then delete the file after processing.  Since upgrading this connector, the files no longer delete which has led to duplicate records in the arcsight manager.  Any ideas on how to fix this other than rolling back to the previous connector version?

Labels (1)
0 Likes
Reply
6 Replies
Highlighted
a2g Absent Member.
Absent Member.

Re: Duplicate records, file process continuously looping

Check the agents[0].mode parameter in agent.properties file.  I believe '0' should be delete, '1' - rename, and '2' - leave alone.

Maybe you can budge it by playing with that parameter.

Anton

0 Likes
Reply
dlamonte1 Absent Member.
Absent Member.

Re: Duplicate records, file process continuously looping

Thanks Anton,

I checked our agent.properties file and it is set to agents[0].mode=DeleteFile

Our ISA connector collects events from two servers.  These logs are copied using xcopy to a directory.  A vbscript reads the log directories and copies the .iis files to the specified log folder.  The connector was initially set up to read this folder for new files and then delete after processing.  As of right now, the copy is working and the file is getting placed in the log folder, the arcsight manager is picking it up but it just continuously processes the same file.

0 Likes
Reply
a2g Absent Member.
Absent Member.

Re: Duplicate records, file process continuously looping

Are you using 'ISA Server File' or 'ISA Multiple Server File' Connector?
0 Likes
Reply
tearic1 Absent Member.
Absent Member.

Re: Duplicate records, file process continuously looping

Please check that did your user right, which run by arcsight agent, can remove (del) files on remote log folder.

0 Likes
Reply
dlamonte1 Absent Member.
Absent Member.

Re: Duplicate records, file process continuously looping

Initially when trying to fix the issue, we selected ISA config for the connector.  We have just recently re-created the entire connector and set it as a regex folder follower.  After copying over some configuration settings, we were able to process a file and have it delete after processing when running as an application.  We switched the connector over to run as a service and it processed the file multiple times and just kept looping.  We are testing our copy process tonight with the connector switched back to run as an application.  When I have results, I will update.  Thanks all.
0 Likes
Reply
dlamonte1 Absent Member.
Absent Member.

Re: Duplicate records, file process continuously looping

After working on this for a while, I upgraded the connector to the newest version.  Did a compare of the properties files and other configurations from the previous connector.  After that the jobs were still not able to process.  I bumped up the EPS to 1000 and the files managed to process and delete after processing.  There was one error which support agreed was acceptable.  That was the file starts to process while the log files are still being copied in the directory.  After about 5 minutes the copy finishes, the error clears and the everything processes fine.

0 Likes
Reply
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.