This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

ArcSight search never completes

I am observing an issue from our ArcSight console when doing any basic search.  From the Analyze > Search page, when you enter a search string and click GO, the search never completes.  The number of scanned events eventually stops incrementing, but the search appears to keep going and never actually stops to indicate it has completed.  You have to manually click the Cancel button every time. This just started happening recently.

We are running HPE ArcSight Logger: 6.3.1.7874.0.  Are there any general issues which can cause this, and what would be a good option to try and fix this?  Unfortunately I don't know a whole lot about this product, and was hoping to find some common things to check/try.

Jim

  • 0  

    Jim,

    I would suggest opening a support ticket to assist you getting this addressed and help to get you up to speed on Arcsight Logger.  If you need assistance opening a support ticket let me know and we can sync up offline.

    Thank you,

    Dale Dowden

  • 0 in reply to   

    good luck to open ticket for logger version 6.3.1, they will tell to update.

  • 0

    Can you retrieve the logs from the application? I can't fully recall 6.x logger UI to tell you where it is but in the newer release, it's under Configuration -> Advanced Configuration -> Retrieve Logs. You'll want to go through the logs under "/opt/arcsight/userdata/logger/logs/" I would look in logger_mysqld.log to start for any errors. 

  • 0 in reply to 

    The "Take Me To" box should be on the main Logger page. You can type in "Retrieve Logs" and it should take you to the page to get the logs.