Increase logger throughput

  • Document ID:KM02174570
  • Creation Date:07-Mar-2016
  • Modified Date:07-Mar-2016
    • Micro Focus Products:
      arcsight connector appliance
      arcsight express appliance
      arcsight identity view
      arcsight esm appliance
      arcsight application security monitor
      arcsight express
      arcsight esm compliance insight pkgs
      arcsight express virtual appliance
      arcsight express all in one
      arcsight application view
      arcsight enterprise view
      arcsight dns malware analytics
      arcsight express aio appliance
      arcsight enterprise security manager

Archived Content: This information is no longer maintained and is provided "as is" for your convenience.

Summary

< !--Obsolete--> Michaela: author never responded back with updates on this new article hence retiring as not all necessary information was included Use when event batch size is too big

Question

To increase logger throughput when event batch size is too big:

i. Navigate to /opt/arcsight/logger/current/arcsight/logger/bin/scripts

ii. Make a backup of servers.sh file ( cp servers.sh servers.sh.default)

iii. Edit servers.sh
- Find the line beginning “ARCSIGHT_JVM_OPTIONS”, and edit the –Xmx4096m and replace it with –Xmx8144

iv. Navigate to /opt/arcsight/logger/ userdata/logger/user/logger/

v. Edit logger.properties
- Add rawevent.reader.capacity=8 (if the value is already there, edit it to equal 8)

vi. Stop Logger Service (logger_server) and after successfully stop, start again Logger Service.