arcsight_web service is mixed_statuses

Document ID:KM02072492
Creation Date:25-Jan-2016
Modified Date:06-Jun-2016
- Micro Focus Products:
  arcsight express appliance
  
  arcsight express virtual appliance
  
  arcsight express all in one
  
  arcsight esm appliance
  
  arcsight express aio appliance
  
  arcsight express
  
  arcsight enterprise security manager
  
  arcsight management center

Summary

Troubleshooting steps on error being displayed when checking the manager services status: "arcsight_web service is mixed_statuses"

Error

When connecting to the HP ArcSight Enterprise Security Manager (ESM) Web Console the error message below is thrown:

Error: Manager connection failure

The comand /sbin/services arcsight_services status all shows all services up and running except for the web service. It shows:

aps service is available

arcsight_web service is mixed_statuses

execprocsvc service is available

logger_httpd service is available

logger_servers service is available

logger_web service is available

manager service is initialized

mysqld service is available

postgresql service is available

Cause

Web Server depends on the manager service to be available before it can be fully started so it is normal to see such service in mixed_status until the manager is fully available. If the status remains the same after the manager is available then the most probable cause is that a new certificate was created for the manager, which prevents the Web Service to fully connect and this causes the web service to crash.

Fix

1. Login as arcsight user to the ESM server

2. Make a backup of the certificates:

cp -p /opt/arcsight/web/jre/lib/security/cacerts /opt/arcsight/web/jre/lib/security/cacerts-bck

cp -p /opt/arcsight/manager/jre/lib/security/cacerts /opt/arcsight/web/jre/lib/security/cacerts

3. If still no help, then rerun the web server setup, login as arcsight user:

a) cd /opt/arcsight/web/bin

b) ./arcsight websetup

c) Follow through, press enter for all default in [ ]

d) Replace the self-sign certificate (to check what certificate you are using, use: ./arcsight tempca -i)

e) Upload /opt/arcsight/web/logs/default folder to a support case if still having issue.

4. Restart the web server if it still in mixed_statuses