Highlighted
slakfu1 Absent Member.
Absent Member.
378 views

Logger 5.3 RHEL Installer Issue

We ran into a similar issue as the OP from this post: https://protect724.arcsight.com/message/29380#29380

This was happening while trying to install the software logger (version 5.3.0.6684.0) for the first time on a fresh installation of RHEL. It was causing the installer to get stuck in the "Initialization" phase, specifically in the post_logger_install.sh script where it was waiting for the arcsight_logger service to write that it had successfully started-up to a file that was being checked by the is_server_up.sh script. It was at this point where the infinite loop was occurring - post_logger_install.sh checks that file to see if acrsight_logger started up successfully, sleeps for 5 seconds, checks it again, and so on. From the user's perspective it just looked like the installer had hung on something, but the arcsight_logger service has actually written the exception to the logger_server.out.log file.

The /etc/localtime and /etc/sysconfig/clock on our RHEL installation was configured as just "GMT". For some reason the arcsight_logger service doesn't know what to do with this setting or there's some other bug, but the bottom line is that the post_logger_install.sh script in the Arcsight Installer doesn't handle the ungraceful crash of the arcsight_logger service.

To resolve this issue, we simply changed the /etc/localtime to a non-GMT timezone since this server was actually in the GMT/GMT0 timezone (we changed it to Europe/London and made the corresponding change to /etc/sysconfig/clock).

Hope this helps,

slakfu


Labels (1)
0 Likes
Reply
3 Replies
Honored Contributor.. SIEM-TECH Honored Contributor..
Honored Contributor..

Re: Logger 5.3 RHEL Installer Issue

slakfu,

Thank you for posting this information, we will have to test this.  Has this been submitted as a bug to ArcSight that you know of?

Thank you,

Mike

0 Likes
Reply
slakfu1 Absent Member.
Absent Member.

Re: Logger 5.3 RHEL Installer Issue

darookie,

I have not posted this as a bug yet. What's the best method for submitting a bug of this nature?

Thanks.

0 Likes
Reply
Honored Contributor.. SIEM-TECH Honored Contributor..
Honored Contributor..

Re: Logger 5.3 RHEL Installer Issue


slakfu,

No idea, never done it.   We have a pretty good connection with the engineers who now know so I am sure this will get moved up.

I would like to thank you however and give credit for your finding.  This has been a nail in our side for months.  We tried a couple preliminary tests changing the time zone and they have been successful.

Thanks again!  -Mike

0 Likes
Reply
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.