Reporting problem - ESM 6.5
We have several reports with configured jobs scheduled to run weekly and monthly, but we are not receving those reports
by email, even though we have the correct configuration on the "email to" field of the common parameters of the job.
We are getting this info lines in the sree.log:
[INFO] Jul 7, 2015 12:29:25 PM: Destroy report: ArcSightReportV4.14362685404751@local total 1
[INFO] Jul 7, 2015 12:36:15 PM: Destroy report: ArcSightReportV4.14362676477851@local total 0
[INFO] Jul 7, 2015 3:20:54 PM: Destroy report: ArcSightReportV4.14362788048701@local total 1
[INFO] Jul 7, 2015 3:26:10 PM: Destroy report: ArcSightReportV4.14362783246231@local total 0
[INFO] Jul 7, 2015 4:44:37 PM: Destroy report: ArcSightReportV4.14362838493461@local total 0
[INFO] Jul 7, 2015 4:46:31 PM: Destroy report: ArcSightReportV4.14362839634061@local total 0
[INFO] Jul 7, 2015 4:47:47 PM: Destroy report: ArcSightReportV4.14362840632711@local total 0
[INFO] Jul 7, 2015 4:50:38 PM: Destroy report: ArcSightReportV4.14362842068291@local total 0
cant this be related to the issue we are having?
The internal audit events don't say much.
The issues we are facing are regarding to scheduled reports, all adhoc reports are generated and sent by email.
Are you using the internal SMTP server or the external SMTP, because we had a similar kind of issues in sending teh reports. we found that there is a bug in internal SMTP on arcsight express, hence i configured external SMTP, then this issue got fixed
if you are using internal SMTP, please use external SMTP
We've been using the internal SMTP for a long time and we just started having problems recently.
Moreover, other notifications are working fine.
what kind of bug did you had?
Thank you in advance.
All of the sudden internal SMTP will stop working, even we had internal SMTP configured in my express appliance for last 2 yrs and ran without any issue, but all of the sudden it started not sending the reports and i opened a case with support and they informed the same that internal smtp is having some bug.
hence i started using External SMTP, it works fine.
try with External SMTP, its very easy to do the configuration change from arcsight front and from exchange team front