Logger message

[rommel]

Hello all,

I am currently receiving the following notification/message from Logger when attempting to modify Event Output -> Forwarders page.

"Unable to perform operation, previous operation is still in progress"

It is basically just hanging on that screen. Queries continue to run, all processes are showing as "running."

Seems like something is hung up, how can I tell what may be causing this? Any thoughts or suggestions are welcomed. Thank you all.

v/r,

rom

[DaveH1]

The Logger forwarder would be the first place to check.

$LOGGER_HOME/arcsight/connector/current/logs

agent.out.wrapper.log & agent.log

there is also the logger_processor.log ($LOGGER_HOME/arcsight/logger/logs) which is more about forwarder internal processes.

Either of these 3 should give you some clue as to what's going in

[rommel]

Thank you Dave,

The issue was resolved by level 2 support. I thank you for your assistance.

[emre_cn90]

I have same issue here how did you solve the problem?

[rommel]

Hi Emre,

It was resolved by Support, it appears many of the functions were hung. Sorry I do not have a clear answer for you.

rom

[abdelhafez.moha1]

Hello Rommel,

I followed https://softwaresupport.hp.com/group/softwaresupport/search-result/-/facetsearch/document/KM01530198

But for logger_processor.properties and it resolved the issue.

Regards,

Hafez

[Gayan]

1. Stop all of the services:

./opt/local/monit/bin/monit stop all

NOTE: Use "/opt/local/monit/bin/monit status" to check when they are all stopped.

2) Move logger logger_receiver.properties file to /tmp:

cd /opt/arcsight/userdata/logger/user/logger

mv logger_receiver.properties /tmp/logger_receiver.properties

3) Create a new logger_receiver.properties file:

touch logger_receiver.properties

4) Change the ownership to arcsight:arcsight:

chown arcsight:arcsight logger_receiver.properties

5) Overwrite the new file with the original logger_receiver.properties file from /tmp directory:

cd tmp

cp -f logger_receiver.properties /opt/arcsight/userdata/logger/user/logger

6) Start services:

./opt/local/monit/bin/monit start all

This will be sorted your issue