NOTICE: Branded Content
NOTICE: Certain versions of content (“Material”) accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.
ArcSight User Discussions
cancel

ESM Case Size Limit

bwithrow Respected Contributor.
Respected Contributor.

ESM Case Size Limit

We are running into an issue where we can't create any more cases in ESM 6.8, due to size.  Does anyone have documentation on what partition the cases are held in or how to increase the allocated size?

5 REPLIES
Knowledge Partner
Knowledge Partner

Re: ESM Case Size Limit

That sounds like a weird issue, which exact error message are you getting? I do not think it is related to only cases..

Highlighted
 Honored Contributor... ionut.dan.mosoi  Honored Contributor...
 Honored Contributor...

Re: ESM Case Size Limit

Hi,

can you share the error / errors ?

 

All the best,

Daniel

Trusted Contributor.. markk308 Trusted Contributor..
Trusted Contributor..

Re: ESM Case Size Limit

Hi,

I'n working with OP on this issue.  We have hit a maximum byte count for attachments.  I know this because when I delete an attachment, I am able to attach muliple files that are the sum of the attachment that I removed:

Delete 300kb file, can add three 100KB files..  Afterwards, I am no longer able to attach files.

Is there a configuration file that dictates how much storage space I can dedicate to file attachments?

Attached is the error message I am recieving.

Thank you,

Glenn

Knowledge Partner
Knowledge Partner

Re: ESM Case Size Limit

Hey @markk308

Hmm, i never really used cases before, but i do know they should be stored with other static content in the mysql (as postgresql handles events etc).

So could you post a few things:

On dashboards, in the arcsight administration folder, there should be a "Database Performance" dashboard, which shows the storage you have set for system events etc, can you check if anything is near full.

Another is to check cat /opt/arcsight/logger/data/mysql/my.cnf.

A third would be to look at the server.properties.default to find out which setting is for that specific part.

If none works it would be easier to just contact your support rep, and i am sure they know it as well.

Trusted Contributor.. markk308 Trusted Contributor..
Trusted Contributor..

Re: ESM Case Size Limit

@Marius

Thank you for the help, I've resolved the issue with your suggestion!

I modified the following parameter in the /opt/arcsight/manager/config/server.defaults.properties file:

# ------------------------------------------------------------
# File resource configuration
# ------------------------------------------------------------

# The maximum size for all files content in the system.
# This is measured in MB.
persist.file.size.total.max=

Much appreciated again for your helpful suggestions!

Key Links

Micro Focus is looking for research study participants to help us improve our website. Tell us what you think, and in exchange for your time we'll send you a small thank-you, like a gift card. Sign up or learn more 

Top Contributors Last 30 Days