When connecting to the HP ArcSight Enterprise Security Manager (ESM) Web Console the error message below is thrown:
Error: Manager connection failure
The comand /sbin/services arcsight_services status all shows all services up and running except for the web service. It shows:
aps service is availablearcsight_web service is mixed_statusesexecprocsvc service is availablelogger_httpd service is availablelogger_servers service is availablelogger_web service is availablemanager service is initializedmysqld service is availablepostgresql service is available
Web Server depends on the manager service to be available before it can be fully started so it is normal to see such service in mixed_status until the manager is fully available. If the status remains the same after the manager is available then the most probable cause is that a new certificate was created for the manager, which prevents the Web Service to fully connect and this causes the web service to crash.
1. Login as arcsight user to the ESM server
2. Make a backup of the certificates:
cp -p /opt/arcsight/web/jre/lib/security/cacerts /opt/arcsight/web/jre/lib/security/cacerts-bck
cp -p /opt/arcsight/manager/jre/lib/security/cacerts /opt/arcsight/web/jre/lib/security/cacerts
3. If still no help, then rerun the web server setup, login as arcsight user:
a) cd /opt/arcsight/web/bin
b) ./arcsight websetup
c) Follow through, press enter for all default in [ ]
d) Replace the self-sign certificate (to check what certificate you are using, use: ./arcsight tempca -i)
e) Upload /opt/arcsight/web/logs/default folder to a support case if still having issue.
4. Restart the web server if it still in mixed_statuses