I'd think the main 'feature' is the introduction of Oracle 11g r2. Else it's mostly Standard Content & bugfixes.
We plan to upgrade it withing the next weeks, ESM for now, Oracle is yet to be discussed.
What seems interesting though is the ArcSight Forwarding Connector for those using a SNMP Receiving Monitor Solution. Wondering if it is possible to adapt the SmartConnector to other Monitoring Tools that work similar as HP OMi. Should be possible though with any kind of SNMP Trap Receiving Policy.
I upgrade our ESM from 5.0sp1 Pathc 3 to 5.0 SP2 last Friday. Only issue I ran into was with the upgrade documentation. Our Database was already Oracle 11g. The Document was not very clear on what to do when applying the Arcsight Database if you already have Oracle 11g as the options presented reffered to Oracle or Archiver upgrades. The answer was simply to press cancel.
After the upgrade, the console responce seemed a little better and channels seemed to load a little faster...this is subjective though.
Good luck with your upgrades.
We applied our Update today. A few confusing things we struggled with though:
- ESM 5.0 SP2 Release Notes say supported Versions are:
- ESM v5.0 Patch 1 to v5.0 SP2
- ESM v5.0 SP1 Patch 3 to v5.0 SP2
- ESM Upgrading ArcSight Guide says:
- v5.0 GA and v5.0 SP1 to v5.0 SP2
So we risked it to upgrade from 5.0 SP1 Patch 2 to v5.0 SP2 and so far it runs flawless.
Furthermore it was very unclear if we should apply the Oracle PSU (p12419331_112020_Linux-x86-64.zip) on our Oracle 188.8.131.52 Installation. So we rather let it be. Reason for that was the following Note in the OraclePSU Release Notes:
If you have been previously applying the Oracle Critical Patch Update (CPU),
you can follow these steps to apply the PSU. However, once you apply a PSU,
Oracle recommends that you continue to apply PSUs in the future instead of
It is a bit unclear for us here what Oracles and ArcSights patch management politics is aiming for: Will there be only PSUs in the future? Will CPUs still be delivered as before?
So apparently PSUs are a good thing. Nevertheless this should be discussed with the project and with someone who actually got a real clue of Oracle, atleast in our case.
What i've noticed so far after the patch:
+ The Console seems to be alot faster overall, especially noticable in the Active Channels
+ More Dashboards to monitor ArcSight Depoyment
- Dashboards (Data Monitors) don't work yet in our environment ( Connectors --> Loggers --> ESM ); needs to be further investigated and adjusted.
To be honest i was secretly hoping for better methods of monitoring your SmartConnector Services than having to map the SmartConnector Name into the FlexField1 or similar in this kind of deployment.
Compared to the upgrade from 4.5 to 5.0 for us (which was a nightmare), 5.0 SP1 to SP2 was a breeze. The only obstacle we ran into, which we also ran into with previous upgrades, is that we have too much content for the default heap size in the upgrade scripts.
We had to install SP2 but cancel once we got to the "upgrade" part, modify either the "upgrade.bat" or "managerpostinstall.bat" script (depending on approach for resuming the upgrade) as well as the "resvalidate.bat" script to increase the max heap size, and then resume the upgrade. Other than that all went according to plan.