Appliance Bootup times and Java defunct errors

[RobBrewerAS]

Hi Community,

Has anyone encountered lengthy reboot times? We have a V2 Arcsight Express AIO box and after rebooting, we were able to log in 2-3 minutes after hitting the enter button on an ssh "reboot" however it can now take up to 25 minutes before we able to log in and carry on business as usual.

This leads to the other issue of why we reboot it in the first place - The appliance will randomly stop processing logins and present us with a "connection refused" error and wont let anyone log into the console, the only solution we have found so far is to SSH to the box and reboot it from there.

We are also noticing when doing a "ps -e" command from SSH we see "java <defunct>" twice.

Does anyone have experience of this issue or had similar issues? Are there any better error logging tools/views we can use to troubleshoot this ourselves?

Thanks in advance,

[Vini]

I cannot tell you for sure why this is happening but it seems that you may have java processes becoming defunct and hogging the memory of your box.

Eventually there is so little memory available that SSH doesn't work anymore.

What version of ESM do you have there?

When did the problem start?

Have you installed or updated anything lately?

[RobBrewerAS]

Hi,

The Arcsight version is 5.0.0.6521.1

The problem has been occurring for 6 months or more now, we haven't changed anything that could of affected the AIO box.

We are tempted to try and factory reset however have a lot of information that we need to save to an ARB, however we are also concerned that one of these settings may bring the issue back.

Is there any troubleshooting we can go through to check what is causing the issue? We can log into SSH fine at any point, its connect via the manager console that doesn't work all time, until we reboot the box via SSH.

Thanks