I am currently receiving the following notification/message from Logger when attempting to modify Event Output -> Forwarders page.
"Unable to perform operation, previous operation is still in progress"
It is basically just hanging on that screen. Queries continue to run, all processes are showing as "running."
Seems like something is hung up, how can I tell what may be causing this? Any thoughts or suggestions are welcomed. Thank you all.
The Logger forwarder would be the first place to check.
agent.out.wrapper.log & agent.log
there is also the logger_processor.log ($LOGGER_HOME/arcsight/logger/logs) which is more about forwarder internal processes.
Either of these 3 should give you some clue as to what's going in
1. Stop all of the services:
./opt/local/monit/bin/monit stop all
NOTE: Use "/opt/local/monit/bin/monit status" to check when they are all stopped.
2) Move logger logger_receiver.properties file to /tmp:
mv logger_receiver.properties /tmp/logger_receiver.properties
3) Create a new logger_receiver.properties file:
4) Change the ownership to arcsight:arcsight:
chown arcsight:arcsight logger_receiver.properties
5) Overwrite the new file with the original logger_receiver.properties file from /tmp directory:
cp -f logger_receiver.properties /opt/arcsight/userdata/logger/user/logger
6) Start services:
./opt/local/monit/bin/monit start all
This will be sorted your issue