Highlighted
Absent Member.
Absent Member.
870 views

HP ArcSight Advisory for Logger Search and Reporting Performance

The HP ArcSight Customer Support team has recently seen a few issues of degraded Logger performance in the areas of search and reporting. This advisory describes those issues, the workarounds (if available) to avoid them, and reminders on the best practices to follow if you are experiencing these issues.

Issue #1: Unresponsive UI

The Symptom

After beginning a search or launching a report, the UI is inaccessible and the Logger becomes unresponsive.  If you try to login at this stage, you may see the following message:

"Operation failed due to system error.  Please check server logs." 

This issue is seen on Loggers running version 5.3 SP1.

The Cause

This error occurs when the primary server process runs out of memory and restarts.  During the time the server process is restarting, all other components of the Logger software are unable to communicate.  We believe Global Summary (a feature of Logger) may be causing this issue. We are working to find the root cause of this issue currently.

Recovery/Workaround

It is possible to turn off the Global Summary feature. Please see the Knowledge Base article http://support.openview.hp.com/selfsolve/document/KM00623373

Issue #2: When multiple concurrent Reports are run, data returned in those reports is inconsistent

The Symptom

If you run multiple concurrent reports (either scheduled or ad-hoc), data returned in the reports may be inconsistent.

The Cause

We believe an internal data inconsistency is causing this issue and are working to find the root cause of this issue currently. As documented in the Logger Administrator’s Guide, our recommendation is that users run no more than 5 reports on Logger at a time.

Recovery/Workaround

To avoid running into this issue, do not run more than 5 scheduled or ad-hoc reports concurrently.  Exceeding this number may cause unexpected behavior.

Issue #3: Degraded Peer Searches

The Symptom

If you peer five or more Loggers, you may experience degraded search performance.

Recovery/Workaround

We recommend limiting the number of peers to no more than 5. A property setting is also available to set this value. Please see the knowledge base article at http://support.openview.hp.com/selfsolve/document/KM00624677

This limitation will be changed in a future version of Logger.

Issue #4: Java Out of Memory

The Symptom

After beginning a search, the UI displays this message:

“There was a problem: java.lang.OutOfMemoryError: unable to create new native thread”. 

This issue is seen on Loggers running version 5.3 SP1.

The Cause

HP ArcSight has traced this issue to a limitation of RHEL 6.2, the certified version of OS for Logger 5.3 SP1. RHEL 6.2 sets the maximum number of user processes to 1024 by default, thus limiting the number of available threads.

Recovery/Workaround

We recommend changing the setting that increases the number of available threads. Please see the Knowledge Base article at http://support.openview.hp.com/selfsolve/document/KM00622455

This change will be automatically implemented in the next patch of Logger.



Suresh Venkataraman

Product Manager, HP ArcSight Logger

Labels (1)
0 Likes
Reply
1 Reply
Highlighted
Super Contributor.
Super Contributor.

Are there any updates to this?

Logs, logs and more logs
0 Likes
Reply
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.