ArcSight ESM Reports can show as empty even when data is known to be present for them

  • KM03688422
  • 05-Aug-2020
  • 05-Aug-2020

Summary

Reports in ESM are blank when their queries have been shown to return data. This can be caused by missing operating system font files.

Error

Reports launched in the in ESM console (scheduled or manual reports) can be displayed as empty or blank, even when a query viewer for the report query is known to return valid data.

Reports sent as email attachment in PDF format, may open with the error "This file cannot be opened because it has no pages".

Examples below:

 

image text

 

image text

 

image text

 

 

Please check the following log file:   /opt/arcsight/var/logs/misc/default/sree.log

Identify the following error:

[ERROR] Jul 31, 2020 10:24:46 AM: Probable fatal error:No fonts found.
java.lang.Error: Probable fatal error:No fonts found.

 

Cause

This is an issue with 'fonts' on the server and can occur if certain font packages are not installed or existing font packages need to be updated.

This may happen if the minimum installation option is chosen when installing the operating system.

The installing or updating of fonts is an Operating System administration issue and not an issue with ESM.

 

 

Fix

Run this command to find out what dejavu fonts and fontconfig software you have installed (Redhat/CentOS):
 

rpm -qa | grep -e dejavu -e fontconfig

 

EXAMPLE OUTPUT:

dejavu-fonts-common-2.33-6.el7.noarch

dejavu-sans-fonts-2.33-6.el7.noarch

dejavu-sans-mono-fonts-2.33-6.el7.noarch

dejavu-serif-fonts-2.33-6.el7.noarch

fontconfig-2.13.0-4.3.el7.x86_64

 

Please consult with your operating system administrator for assistance sourcing and installing these packages.

The following is a suggestion on how these packages could be installed:

If the operating system is configured to use "yum" with the necessary proxies and repositories, you can use yum commands to install the necessary software:

 

yum install fontconfig

yum install dejavu*

 

If you do not have the necessary respositories configured, then you can alternatively download the packages from official Internet sources for your operating system vendor.