ArcSight User Discussions
cancel

Arcsight ESM manager service is available_unresponsive

SOLVED
Go to solution
Highlighted
sandeeprk1 Valued Contributor.
Valued Contributor.

Arcsight ESM manager service is available_unresponsive

Hi Experts,

I see following messsage when I tried start all the ESM services.

Manager service unresponsive.

---------------------------------------------------

aps service is available
execprocsvc service is available
logger_httpd service is available
logger_servers service is available
logger_web service is available
manager service is available_unresponsive
mysqld service is available
postgresql service is available

-------------------------------------------------------

Please suggest how to resolve the issue.PFA.

Thank you.

 

Regards

Sandeep

 

1 ACCEPTED SOLUTION

Accepted Solutions
Micro Focus Expert
Micro Focus Expert
Solution

Re: Arcsight ESM manager service is available_unresponsive

Hello Sandeep,

The message you are seeing indicates that the manager is UP and most of it is available - you should find you can login at he console.  There are some parts of the startup did not complete.

Generally, the "available" message will show after the maanger NGServer component shows "Ready".   You can search the server.log file for a log line like this to show this state of Readiness was reached:

[2018-10-03 10:07:47,636][INFO ][default.com.arcsight.server.NGServer] Ready.

If you do not see that,  then something has not completed during startup.  The most common issues are with rules checkpoints,  data monitor checkpoints and with the pre-load of very large Active/Session Lists.  Any delay in these could affect the startup time of the manager.

Some checkpoint examples

[2018-10-03 10:07:40,257][INFO ][default.com.arcsight.server.NGServer] Data Monitor checkpoint recovery completed. (53 s)
[2018-10-03 10:07:47,380][INFO ][default.com.arcsight.rulesengine.opsj.OPSJRulesEngine] Recovery completed successfully from checkpoint set at Wed Aug 22 15:55:57 CEST 2018
[2018-10-03 10:07:47,388][INFO ][default.com.arcsight.server.NGServer] Rules checkpoint recovery completed. (61

Do you see the value change to available eventually?  Even if that might be many hours?  If so then it could a list load that is causing it.

If there are no obvious errors in the server.log, then one of the best ways to track down the problem is a side-by-side analysis of the server.log for a good startup, against the server.log for a bad one.  If you track through step-by-step and compare,  you wlll likely see a divergence at one point where an activity on the good startup does not match that on the bad...this will give you a hint.

I also recall an issue where the password on the keystores for the manager certificate could cause this problem., something that could occur after an upgrade where the keystores/truststores passwords were not known by the installer.  Did you change them recently?  It may be worth checking that too.

 

Hope this helps,

Darren

 

ArcSight Support
If you find that this or any post resolves your issue, please be sure to mark it as an accepted solution.
5 REPLIES
sanj Trusted Contributor.
Trusted Contributor.

Re: Arcsight ESM manager service is available_unresponsive

Hi,

Did you try to restart the server?

In my case it was a problem at server end, server did not come up when we restartd it.

Thanks & Regards,

Sandeep

sandeeprk1 Valued Contributor.
Valued Contributor.

Re: Arcsight ESM manager service is available_unresponsive

Hi Sanj,

 

Appreciate your valuable response.

 

Initially I restarted only ESM services that did not resolve the issue.

 

Later I did hard reboot, now the manager service is up and I have disabled all the trend and most unused or recently created data monitors but still my CPU usage hovering around 300 to 600% that is unusual (Also load average). PFA.

 

I have thread dumps want to know which resource causing the high CPU consumption.

 Thanks once again.

Regards

Sandeep

Micro Focus Expert
Micro Focus Expert
Solution

Re: Arcsight ESM manager service is available_unresponsive

Hello Sandeep,

The message you are seeing indicates that the manager is UP and most of it is available - you should find you can login at he console.  There are some parts of the startup did not complete.

Generally, the "available" message will show after the maanger NGServer component shows "Ready".   You can search the server.log file for a log line like this to show this state of Readiness was reached:

[2018-10-03 10:07:47,636][INFO ][default.com.arcsight.server.NGServer] Ready.

If you do not see that,  then something has not completed during startup.  The most common issues are with rules checkpoints,  data monitor checkpoints and with the pre-load of very large Active/Session Lists.  Any delay in these could affect the startup time of the manager.

Some checkpoint examples

[2018-10-03 10:07:40,257][INFO ][default.com.arcsight.server.NGServer] Data Monitor checkpoint recovery completed. (53 s)
[2018-10-03 10:07:47,380][INFO ][default.com.arcsight.rulesengine.opsj.OPSJRulesEngine] Recovery completed successfully from checkpoint set at Wed Aug 22 15:55:57 CEST 2018
[2018-10-03 10:07:47,388][INFO ][default.com.arcsight.server.NGServer] Rules checkpoint recovery completed. (61

Do you see the value change to available eventually?  Even if that might be many hours?  If so then it could a list load that is causing it.

If there are no obvious errors in the server.log, then one of the best ways to track down the problem is a side-by-side analysis of the server.log for a good startup, against the server.log for a bad one.  If you track through step-by-step and compare,  you wlll likely see a divergence at one point where an activity on the good startup does not match that on the bad...this will give you a hint.

I also recall an issue where the password on the keystores for the manager certificate could cause this problem., something that could occur after an upgrade where the keystores/truststores passwords were not known by the installer.  Did you change them recently?  It may be worth checking that too.

 

Hope this helps,

Darren

 

ArcSight Support
If you find that this or any post resolves your issue, please be sure to mark it as an accepted solution.
sandeeprk1 Valued Contributor.
Valued Contributor.

Re: Arcsight ESM manager service is available_unresponsive

Hi Darren,

Good Day,

I will analyze the logs for anomaly, your valuable input will help me narrow down my search.

Appreciate your kind support.

Regards

Sandeep

sandeeprk1 Valued Contributor.
Valued Contributor.

Re: Arcsight ESM manager service is available_unresponsive

Hi Darren,

keystores/truststores Changes?

No recent changes.

Very stange but true today I have faced similar problem with my DR ESM.

 

Regards

Sandeep