dipak.vagadiya@ Absent Member.
Absent Member.
895 views

Error in ESM 6.8c Installation.

Hello all,

I am trying to install ESM 6.8c on system having following resources:

- Red Hat 6.5 OS

- processors

- 52 GB RAM

- RAID 10 made of six 600 GB disks.

I have mounted RAID 10 disk on / partition.

While installing, I am getting following error:

ERROR: Error encountered during installation of the CORR Engine Component.

The installation log may be found in the /opt/arcsight/logger directory.

Type 'Quit' to cancel this installation.

I don't find any logger directory in /opt/arcsight.

Please help me to figure it out.

Labels (1)
0 Likes
Reply
8 Replies
charles.w.hanle Absent Member.
Absent Member.

Re: Error in ESM 6.8c Installation.

A few things to check.

1) make sure the account your using has write permissions to /opt and /tmp

1a) can you run touch test on opt and show a file created with the account

2) Make sure /tmp does not have a noexec flag in the FSTAB

3) mkdir arcsight then try installing into arcsights directory (Yes it may sound weird but its what have run into with this software)

4) make sure your NOT installing on an NFS Share. We had the same problem with a logger install

5) have you created the arcsight account as per the instructions in the manual? found on page 21 of the ESM install guide?

Just a few things to help you but most important is make sure you run "chown arcsight:arcsight /opt/arcsight" as root or your install will fail.

0 Likes
Reply
dipak.vagadiya@ Absent Member.
Absent Member.

Re: Error in ESM 6.8c Installation.

Hi Charles,

I did all mentioned in install guide. Still, it's not working.

0 Likes
Reply
charles.w.hanle Absent Member.
Absent Member.

Re: Error in ESM 6.8c Installation.

how far into the install do you get? Can you launch a second window and see if anything gets created in the log directory? Also under /tmp do you see a new directory that has fresh build time and date? if you do do a find . -name *.log and see if you find anything.

Also is SELinux enabled

If so try temporarily disabling it by modifying /etc/selinux/config and then rebooting. do the install then turn it back on.

It should look like the following

# This file controls the state of SELinux on the system.

# SELINUX= can take one of these three values:

#       enforcing - SELinux security policy is enforced.

#       permissive - SELinux prints warnings instead of enforcing.

#       disabled - No SELinux policy is loaded.

SELINUX=disabled

# SELINUXTYPE= can take one of these two values:

#       targeted - Targeted processes are protected,

#       mls - Multi Level Security protection.

SELINUXTYPE=targeted

when your done and you reboot.

when system is back line try the install.

0 Likes
Reply
Highlighted
Samour Absent Member.
Absent Member.

Re: Error in ESM 6.8c Installation.

Some gotchas to be aware of some already covered above:

1-Ensure tzdata is updated

2-Use an existing "valid" timezone:

date

ls -altrh /etc/localtime

source /etc/sysconfig/clock

mv /etc/localtime /etc/localtime.old

ls -ahl /usr/share/zoneinfo

Once you find the appropriate timezone assign it:

ln -s /usr/share/zoneinfo/xx/xx /etc/localtime

3-Ensure hostname is resolvable

4-Ensure /opt/arcsight directory exists before starting the install and is owned by arcsight OS user

5-Ensure installation files are owned by arcsight OS user and he has rwx on the install files

6-Ensure X11 is working

7-Add execute permissions if not already there:

chmod +x /sbin

chmod +x /sbin/ifconfig

chmod +x /sbin/lspci

chmod +x /usr/sbin

8-Update iptables

-A INPUT -m state --state NEW -m udp -p udp --dport 694 -j ACCEPT

-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT

-A INPUT -m state --state NEW -m tcp -p tcp --dport 53 -j ACCEPT

-A INPUT -m state --state NEW -m tcp -p tcp --dport 7789 -j ACCEPT

-A INPUT -m state --state NEW -m tcp -p tcp --dport 9000 -j ACCEPT

-A INPUT -m state --state NEW -m tcp -p tcp --dport 8443 -j ACCEPT

-A INPUT -m state --state NEW -m tcp -p tcp --dport 9443 -j ACCEPT

9-Update Thread limit as root user and then reboot

vi /etc/security/limits.d/90-nproc.conf

* soft nproc 10240

* hard nproc 10240

* soft nofile 65536

* hard nofile 65536

That should be everything to look for.

Aside from that I have had some challenges with EMC SAN so check if there is a storage issue and try a different storage medium.

Hope this helps.

Cheers,

Samer

0 Likes
Reply
dipak.vagadiya@ Absent Member.
Absent Member.

Re: Error in ESM 6.8c Installation.

Still it's not working guys. My partitions are as following:

Filesystem       Size   Used     Avail    Use%   Mounted on

/dev/sda1         300G   12G     289G      4%       /

devtmpfs          26G      0        26G        0%       /dev

tmpfs               26G      0        26G        0%       /dev/shm

tmpfs               26G    8.3M     26G       1%       /run

tmpfs               26G      0          26G      0%      /sys/fs/cgroup

/dev/md0          1.8T     77M      1.7T      1%      /mnt/raid10



Is this causing error?


Thanks for your assistance.

0 Likes
Reply
dipak.vagadiya@ Absent Member.
Absent Member.

Re: Error in ESM 6.8c Installation.

Hello All,

Now, I am installing ESM 6.8c on my local server and facing the same issue again.

Any solution to this error?

0 Likes
Reply
Trusted Contributor.. ralphw Trusted Contributor..
Trusted Contributor..

Re: Error in ESM 6.8c Installation.

It would be preferable to have /opt be its own filesystem.

I've heard from other ArcSight folks that trying things with symlinks around /opt/arcsight won't work well.

If you are intending to have /dev/md0 be the site of ArcSight installation,
you will want to mount it as /opt/ and not /mnt/raid10

Protecting the root filesystem by having ArcSight on a separate partition will be helpful in the long run.

0 Likes
Reply
dipak.vagadiya@ Absent Member.
Absent Member.

Re: Error in ESM 6.8c Installation.

This error has been solved. I was uploading extracted binary file to install. Rather we need to upload tar file in arcsight user's home directory and untar it there only. The we are able to install.

0 Likes
Reply
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.