Community in read only mode June 18 & 19
This community will be set in READ ONLY mode for a while on Tuesday June 18 into Wednesday June 19 while we import content and users from our Micro Focus Forums community site. MORE INFORMATION
el_mejor_ajo1 Absent Member.
Absent Member.
645 views

arcsight archive newids - what's the deal?

Hello,

Is there anyone who could explain the '-newids' tag for the 'arcsight archive' tool?

From the help:

"-newids             newids - All archival objects within an archive will be given new IDs.  All references to these archival objects will have their IDs changed to the new IDs, or removed if the ID is not found in the archive.  This is useful when an archive was created and then all of the resources in the archive were modified to create new resources, but the IDs were retained."

But I have to seen this work in my tests 😞

I'd like to have a multiple resource archive (Use Cases, AL, Active Channels, Rules, Reports, Trends & more) duplicated where all the ID's are to be replaced with new ones to really duplicate content.

Would there be anyone who could explain the inner workings of the '-newids' tag or perhaps push me in the right direction of really duplicating content?

I must be missing something obvious here, but documentation is pretty slim here.

Thanks for the help.

Labels (1)
0 Likes
Reply
18 Replies
Outstanding Contributor.. pushpendra.rath Outstanding Contributor..
Outstanding Contributor..

Re: arcsight archive newids - what's the deal?

Hi,

Did you manage to get some info on this as I am also struggeling to make it work.

Kind Regards,

Pushpendra Rathi

0 Likes
Reply
Highlighted
ekeene Absent Member.
Absent Member.

Re: arcsight archive newids - what's the deal?

I asked the Doc lead for ESM to comment on this. 

0 Likes
Reply
Outstanding Contributor.. pushpendra.rath Outstanding Contributor..
Outstanding Contributor..

Re: arcsight archive newids - what's the deal?

Thanks 🙂

Lets see when he is gona reply....

0 Likes
Reply
ekeene Absent Member.
Absent Member.

Re: arcsight archive newids - what's the deal?

Hi,

The ESM Doc lead is Jane Mulcaster. (https://protect724.arcsight.com/people/jmulcaster)

You can contact her about this issue.

Thanks,

Liz

0 Likes
Reply
jane.mulcaster@ Absent Member.
Absent Member.

Re: arcsight archive newids - what's the deal?

I am not the subject matter expert for this, but I can research it and figure out the issue so I can appropriately redirect your question. Please stand by...

0 Likes
Reply
el_mejor_ajo1 Absent Member.
Absent Member.

Re: arcsight archive newids - what's the deal?

Cool! Standing by..

0 Likes
Reply
el_mejor_ajo1 Absent Member.
Absent Member.

Re: arcsight archive newids - what's the deal?

Jane,

Have you found someone who could explain this bit?

Thanks!

0 Likes
Reply
dsharan1
Visitor.

Re: arcsight archive newids - what's the deal?

It seems that the -newids option is not working as expected. You should file a support ticket so that it goes through the investigation process. It would also be good to know the use-case you have. There might be alternate ways to solve your use-case.

Dhiraj

0 Likes
Reply
sparky1 Absent Member.
Absent Member.

Re: arcsight archive newids - what's the deal?

Certainly seems like its bust ... was testing some content sync stuff this morning, and I can't get it to generate new ID's.

0 Likes
Reply
acappelli Contributor.
Contributor.

Re: arcsight archive newids - what's the deal?

Submitted a SR to HP regarding newids not working and here is my reply:

Title: Product Technical Issue:Arcsight Archive tool -newids option does not seem to work.

*** Start of Message ***

Hi Angelo,

We had identified the issue with a bug ID ESM-47652 - Using archive tool with newids flag does not work.

Our developer is working on the issue and it requires major changes and therefore should be addressed in our major release. We will notice you once the issue is fixed in our future release.

Best regards,

Nellie

Really it's not working! "But for how long Mr Spock, for how long".

Can you believe this they will fix it in the next major release.  How many releases have there been since this was first report over a year ago.

I can't believe this company, my confidence in this product is really going to hell.


0 Likes
Reply
el_mejor_ajo1 Absent Member.
Absent Member.

Re: arcsight archive newids - what's the deal?

Angelo,

Thanks for this follow-up.

Yours and mine (confidence) could meet up there. There is a little special corner for confidences like ours.

0 Likes
Reply
sparky1 Absent Member.
Absent Member.

Re: arcsight archive newids - what's the deal?

haha ... at least they said they would fix it. My ticket got the response that the archive utility is no longer supported.

0 Likes
Reply
vip
New Member.

Re: arcsight archive newids - what's the deal?

Really ?! Is there an alternative to automatically and periodically export a set of resources then ? Package is not the answer, it has to be done manually...

Also is this "newids" option required to migrate content from 5.X to 6.X ? We're a bit afraid of this migration.

0 Likes
Reply
sparky1 Absent Member.
Absent Member.

Re: arcsight archive newids - what's the deal?

The "newid" isn't such a big issue really. Not sure if you've noticed but even in packages from ArcSight, the resource ID's always remain the same. In other words check the resource ID for the same rule on two different systems and they will be the same.

You can use package as it can be called from the command line. There is a presentation from protect 11 by SIAC that has done this. One thing for sure is that its not easy 😉

0 Likes
Reply
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.