Summary
Error
During the creation of event archives in ArcSight ESM, the operation can fail.
When hovering the mouse pointer over the failed archive in ArcSight Command Center (Administration >Storage and Archive> Archive Jobs)
the popup message shows an error message resembling the following:
/archives/064xxxxxxxxxx/202110215_tmp/ArcSight_Metadata_csv_gz (No such file of directory)
Cause
This problem occurs when the archive action is unable to create a temporary directory to store the daily archive files.
This can happen if
- The disk where the archives are located is not mounted with correct permissions.
- The directory structure where archives are located does not have the correct ownership or permissions.
Fix
Scenario 1.
The disk where the archives are located is not mounted with correct permissions.
Identify the disk where the archives are stored using the 'mount' command.
Check to see if the permissions are incorrectly set to Read Only 'ro'.
The permssions should be set to Read Write 'rw'.
If the permissions are set to any combination other than 'rw' you will need to unmount the disk and mount it again with the correct permissions for example
umount /dev/sdb
mount -o rw /dev/sdb /archives
After correcting the mount permssions you do not need to stop and start the ESM services.
Scenario 2.
The directory structure where archives are located does not have the correct ownership or permissions.