Do you have feedback on our new interface?
Do you have feedback on our new interface? Let us know HERE
Micro Focus Frequent Contributor
Micro Focus Frequent Contributor
1375 views

Reduced EPS performance of ArcSight Smart Connector 7.8.0.8070.0 sending events to Logger

 

UPDATE: Fix Posted on this thread - https://community.softwaregrp.com/t5/ArcSight-Discussions/FIX-for-Reduced-EPS-of-ArcSight-Smart-Connector-7-8-0-8070-0/td-p/1648555

We have identified an EPS performance issue with ArcSight Smart Connectors 7.8.0.8070.0 sending events to Logger. EPS drops to few hundred events and events are cached in Connectors.

In our initial analysis we have found the issue to be caused by the upgraded Java version 1.8.0_161 included with Connectors 7.8.0.8070.0

A possible workaround of using the connector setting "transport.loggersecure.connection.persistent=true", "transport.loggersecurepool.connection.persistent=true" is mentioned in this thread. This setting improves EPS performance, but has limitations. Customers using it should be aware that it may affect the peer searching performance depending on their environment (number of connectors sending events to Logger, number of concurrent searches, number of reports etc.).

We are actively working on resolving the issue and will provide an update in the near future. For additional questions or comments please contact your sales rep, sales engineer, or support team.

 

ArcSight Product Team

 

 

0 Likes
7 Replies
Micro Focus Expert
Micro Focus Expert

Re: Reduced EPS performance of ArcSight Smart Connector 7.8.0.8070.0 sending events to Logger

@kousalya.nagara

This caused us quite  extensive issues , and if this is known it is a bit irritating that the version is still available for downloading, even without extra alerts that it will cause issues against loggers.

Is there any update when this will be resolved?

-----------------------------------------------------------------------------------------
All topics and replies made is based on my personal opinion, viewpoint and experience, it does not represent the viewpoints of MicroFocus.
All replies is based on best effort, and can not be taken as official support replies.
//Marius
0 Likes
alexandros_n Honored Contributor.
Honored Contributor.

Re: Reduced EPS performance of ArcSight Smart Connector 7.8.0.8070.0 sending events to Logger

It's available because either there is no indication of the issue when the destination is only ESM or it's HPE/Microfocus logic. This release was very problematic from the start.

0 Likes
Micro Focus Expert
Micro Focus Expert

Re: Reduced EPS performance of ArcSight Smart Connector 7.8.0.8070.0 sending events to Logger

That is not really a good reason though, as the majority of ArcSight users uses the ESM/Logger combination, and in most cases the Logger will be one of those destinations no?

They should at least have a big warning sign when downloading it, or something similar to that when you try to add a logger destination during installation.

-----------------------------------------------------------------------------------------
All topics and replies made is based on my personal opinion, viewpoint and experience, it does not represent the viewpoints of MicroFocus.
All replies is based on best effort, and can not be taken as official support replies.
//Marius
0 Likes
alexandros_n Honored Contributor.
Honored Contributor.

Re: Reduced EPS performance of ArcSight Smart Connector 7.8.0.8070.0 sending events to Logger

I wouldn't say majority but a good number. Also some may have different combination (ESM->Logger)

0 Likes
PeSeKa Honored Contributor.
Honored Contributor.

Re: Reduced EPS performance of ArcSight Smart Connector 7.8.0.8070.0 sending events to Logger

Apart from the problem you have, from the hp source, the smart connector 7.8.0 has some bugs and a downgrade to the previous version is suggested.

0 Likes
Outstanding Contributor.. douglas.baker@h1 Outstanding Contributor..
Outstanding Contributor..

Re: Reduced EPS performance of ArcSight Smart Connector 7.8.0.8070.0 sending events to Logger

I'd suggest that in additional to the original entry recommendation on a couple of agent properties that the following for the per-transport be tried;

- if the Destination is ESM;

http.transport.multithreaded=true
http.transport.threadcount=24

Note: it now appears that ARST Connector Devo has by default enabled other transports to be multithreaded by default and set the transport thread count low, e.g. 1 (Kafka notably different). You can check the properties in .../config/agent/ for syntax.

 

If doing the above improves your forwardign performance you will see EPS out climb (high depending on other performance considerations and properties) and the cache should deplete at a rate higher than the nbound EPS.

 

It would be nice if after trying this the impact was reported herein.

 

While it has been stated that there appears to be a Java issue fundamentally transport does seem to have issues across many (if not all) of the Destination types and for whatever reason that '24' (thread count) appears to be a magic number for very high EPS situations.

 

Note: 'complete' Connector tuning also includes heap to slow 'Full GC' down, Destiation Batching, inbound side multithreading,.... so the suggestion here is to try the one property pair change and monitor it for behavioural change.

 

Doug

 

0 Likes
Highlighted
Micro Focus Frequent Contributor
Micro Focus Frequent Contributor

Re: Reduced EPS performance of ArcSight Smart Connector 7.8.0.8070.0 sending events to Logger

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.