arcsight_web service is mixed_statuses

  • KM02072492
  • 25-Jan-2016
  • 06-Jun-2016


Troubleshooting steps on error being displayed when checking the manager services status: "arcsight_web service is mixed_statuses"


When connecting to the HP ArcSight Enterprise Security Manager (ESM) Web Console the error message below is thrown:

Error: Manager connection failure

The comand /sbin/services arcsight_services status all shows all services up and running except for the web service. It shows:

aps service is available
arcsight_web service is mixed_statuses
execprocsvc service is available
logger_httpd service is available
logger_servers service is available
logger_web service is available
manager service is initialized
mysqld service is available
postgresql service is available


Web Server depends on the manager service to be available before it can be fully started so it is normal to see such service in mixed_status until the manager is fully available. If the status remains the same after the manager is available then the most probable cause is that a new certificate was created for the manager, which prevents the Web Service to fully connect and this causes the web service to crash.


1. Login as arcsight user to the ESM server

2. Make a backup of the certificates:

    cp -p /opt/arcsight/web/jre/lib/security/cacerts  /opt/arcsight/web/jre/lib/security/cacerts-bck

    cp -p /opt/arcsight/manager/jre/lib/security/cacerts  /opt/arcsight/web/jre/lib/security/cacerts

3. If still no help, then rerun the web server setup, login as arcsight user:

    a) cd /opt/arcsight/web/bin

    b) ./arcsight websetup

    c) Follow through, press enter for all default in [ ]

    d) Replace the self-sign certificate (to check what certificate you are using, use: ./arcsight tempca -i)

    e) Upload /opt/arcsight/web/logs/default folder to a support case if still having issue.

4. Restart the web server if it still in mixed_statuses