ArcSight Discussions
cancel

ESM Case Size Limit

bwithrow Respected Contributor.
Respected Contributor.

ESM Case Size Limit

We are running into an issue where we can't create any more cases in ESM 6.8, due to size.  Does anyone have documentation on what partition the cases are held in or how to increase the allocated size?

5 REPLIES
Highlighted
Marius Honored Contributor.
Honored Contributor.

Re: ESM Case Size Limit

That sounds like a weird issue, which exact error message are you getting? I do not think it is related to only cases..

 Super Contributor... ionut.dan.mosoi  Super Contributor...
 Super Contributor...

Re: ESM Case Size Limit

Hi,

can you share the error / errors ?

 

All the best,

Daniel

markk308 Trusted Contributor.
Trusted Contributor.

Re: ESM Case Size Limit

Hi,

I'n working with OP on this issue.  We have hit a maximum byte count for attachments.  I know this because when I delete an attachment, I am able to attach muliple files that are the sum of the attachment that I removed:

Delete 300kb file, can add three 100KB files..  Afterwards, I am no longer able to attach files.

Is there a configuration file that dictates how much storage space I can dedicate to file attachments?

Attached is the error message I am recieving.

Thank you,

Glenn

Marius Honored Contributor.
Honored Contributor.

Re: ESM Case Size Limit

Hey @markk308

Hmm, i never really used cases before, but i do know they should be stored with other static content in the mysql (as postgresql handles events etc).

So could you post a few things:

On dashboards, in the arcsight administration folder, there should be a "Database Performance" dashboard, which shows the storage you have set for system events etc, can you check if anything is near full.

Another is to check cat /opt/arcsight/logger/data/mysql/my.cnf.

A third would be to look at the server.properties.default to find out which setting is for that specific part.

If none works it would be easier to just contact your support rep, and i am sure they know it as well.

markk308 Trusted Contributor.
Trusted Contributor.

Re: ESM Case Size Limit

@Marius

Thank you for the help, I've resolved the issue with your suggestion!

I modified the following parameter in the /opt/arcsight/manager/config/server.defaults.properties file:

# ------------------------------------------------------------
# File resource configuration
# ------------------------------------------------------------

# The maximum size for all files content in the system.
# This is measured in MB.
persist.file.size.total.max=

Much appreciated again for your helpful suggestions!

Key Links
 

GDPR goes into effect on 25 May 2018!

We have created a 9-webinar series, (1 overview webinar and 8 use-cases) aligned to the ‘five critical technology capabilities for GDPR compliance scenarios’ as set out by PwC. Find more details and links here!

  Accidental non-compliance could be costly!

Top Contributors Last 30 Days