A way to re-initiate failed events backup

[Infosec]

Hi, 

Does anyone know if there is any way to re-initiate failed daily events backup in ArcSight Logger? After long absense I have noticed that a number of daily backups failed and I need to recreate them, however I cannot find any way in the UI to do this automatically. 

[Jesper_Bassoe]

I would raise a support ticket.

I had the same problem a week ago on the ESM and got this from support - Perhaps something similar for Logger exists

1. Login to Command Center and Access Administration > Storage and Archive
2. Get the ID of the archive job inside the retention period of the storage group that was deleted by mistake.
3. Login to postgresql by running the command /opt/arcsight/logger/current/arcsight/bin/psql -U web -d rwdb
4. Run the command select * from alg_eventarchive_ng where id = '<ARCHIVEID>'; to confirm the archive job exists
5. Run the command delete from alg_eventarchive_ng where id ='<ARCHIVEID>; to delete the archive job
6. Run the command \q to exit postgresql
7. Run the command to stop ESM services /etc/init.d/arcsight_services stop
8. Run the command to start ESM services again /etc/init.d/arcsight_services start
9. Once services are started login to the Command Center and Go to Administration > Storage and Archive and confirm the archive is available again with status not schedule
10. Select the archive and click on the button archive now so the archive is done

[Infosec · Accepted solution]

So our support team told us a simple solution.

Delete the failed archives. 

Recreate archive for the specified period. If this period spans several days, it will automatically split them into daily chunks.