ArcMC 2.6 Release Notes

HPE ArcSight Management Center
Software Version: 2.6
Release Notes
April 15, 2017

Legal Notices
Warranty
The only warranties for Hewlett Packard Enterprise products and services are set forth in the express warranty statements
accompanying such products and services. Nothing herein should be construed as constituting an additional warranty.
Hewlett Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein.
The information contained herein is subject to change without notice.
The network information used in the examples in this document (including IP addresses and hostnames) is for illustration
purposes only.
HPE ArcSight products are highly flexible and function as you configure them. The accessibility, integrity, and confidentiality
of your data is your responsibility. Implement a comprehensive security strategy and follow good security practices.
This document is confidential.
Restricted Rights Legend
Confidential computer software. Valid license from Hewlett Packard Enterprise required for possession, use or copying.
Consistent with FAR 12.211 and 12.212, Commercial Computer Software, Computer Software Documentation, and Technical
Data for Commercial Items are licensed to the U.S. Government under vendor's standard commercial license.
Copyright Notice
© Copyright 2017 Hewlett Packard Enterprise Development, LP
Follow this link to see a complete statement of copyrights and acknowledgements:
https://www.protect724.hpe.com/docs/DOC-13026
Support
Phone Alistof phone numbers is available on the HPE ArcSightTechnical Support
Page: https://softwaresupport.hpe.com/documents/10180/14684/esp-support-
contact-list
Support Web Site https://softwaresupport.hpe.com
Protect 724 Community https://www.protect724.hpe.com
Contact Information
Release Notes
HPE ArcSight Management Center 2.6 Page 2 of 16

Contents
About ArcSight Management Center 4
What’s New in this Release 5
Technical Requirements 6
For ArcSight Management Center 6
For Managed ArcSight Products 7
Installer Files 7
ArcMC Appliance OS Upgrade Files 8
Prerequisite to Installation for RHEL 7.x 8
Upgrading ArcMC 9
Upgrade Prerequisites 9
Agent Upgrade Procedure 11
Fixed Issues 12
Open Issues 13
Send Documentation Feedback 16

About ArcSight Management Center
ArcSight Management Center (ArcMC), one of the ArcSight Data Platform (ADP) family of products, is
a centralized management tool that simplifies security policy configuration, deployment maintenance,
and monitoring in an efficient and cost-effective way.
ArcMC offers these key capabilities:
• Management and Monitoring: deliver the single management interface to administrate and monitor
ArcSight managed nodes, such as Event Broker, Loggers, Connectors, Connector Appliances, and other
ArcMCs.
• SmartConnector Hosting: for the hardware appliance, as a platform to instantiate (host and execute)
SmartConnectors.
ArcMC includes these benefits:
l Rapid implementation of new and updated security policies
l Increased level of accuracy and reduction of errors in configuration of managed nodes
l Reduction in operational expenses

What’s New in this Release
This version of ArcMC includes the following new features and enhancements:
l Event Broker Management: ArcSight Event Broker management includes route and topic creation,
as well as health and status parameter monitoring. Monitored parameters for Event Broker include
CPU Usage, Memory, Disk Usage, Event Broker Throughput, Total EPS In, Event Parsing Error,
Stream Processing EPS, and Stream Processing Lag.
l Improved Node Management Interface: The Node Management interface has been improved for
clarity and ease of use.
l Improvements to Topology View: The Topology View now includes many improvements, including
time-out settings, to age out inactive devices and remove them from management.
l Improved Import Hosts Process: Importing hosts from a CSV will take less time than formerly, as
jobs run in parallel.
l Improved License Consumption Report: The License Consumption report can now be run for a
specified time interval, instead of an entire year.
l New Rules: Several additional monitoring rules have been enabled by default. These can be edited or
deleted as preferred.
For detailed information about ArcMC 2.6 features and functionality, refer to the ArcMC 2.6
Administrator's Guide, and other documentation, available from the ArcSight Product Documentation
Community on Protect 724.
Release Notes
What’s New in this Release

HPE ArcSight Management Center (2.6) Page 6 of 16
Technical Requirements
For ArcSight Management Center
Server For software form factor:
l Red Hat Enterprise Linux 6.8 or 7.3
l CentOS 6.8 or 7.3
For appliance upgrade: Red Hat Enterprise Linux 6.8 or 7.3*
*Additionally, for RHEL7.x installation of software ArcMC: See "Prerequisite to Installation for RHEL
7.x" on page 8.
Client
System
l Windows 7, 8, 10
l MacOS 10.8 or later
l RHEL 6.8 or 7.3
CPU 1 or 2 Intel Xeon Quad Core (or equivalent)
Memory l 16 GB RAM
l 80 GB Disk Space (for software form factor)
Supported
Client
Browsers
l Internet Explorer 11
l Microsoft Edge (version current as of release date)
l Firefox ESR (version current as of release date)
l Google Chrome (version current as of release date)
Screen
Resolution
Optimal screen resolution is 1920x1200
Hardware
Models
For new and upgraded ArcMC appliance deployments, all models C650x running RHEL 6.8 and
models C660x running RHEL 7.3

For Managed ArcSight Products
Managed Product Software Form Factor
Hardware
(Appliance)
ArcMC Agent
Version
Required
SmartConnector v6.0.3 or later. Applies to software
connectors running on ArcMC Appliance,
Connector Appliance, Logger (L3XXX), or
separate server.
N/A ArcMC Agent is
not required.
Logger v6.2, v6.2 P1, v6.3, v6.3.1, v6.4 v6.1, v6.1 P1, v6.2, v6.2
P1, v6.3, and v6.3.1 on
models LX50X
and LX60X
v2.6
ArcMC v2.2, v2.2 P1, v2.5, v2.5.1, v2.6 v2.1, v2.2, v2.2 P1, v2.5,
v2.5.1 and v2.6 on
models C650X and
C660X.
v2.6
Connector Appliance v6.4 P3 or v6.4 P3 (6885) Hotfix v6.4 P3, on models
CX400 or CX500
v2.6
Event Broker v2.0 N/A ArcMC Agent is
not required
Installer Files
Available from the HPE download site, the installer files for ArcSight Management Center 2.6 are
named as follows:
l For Software ArcMC: ArcSight-ArcMC-2.6.<build number>.0.bin
l Software remote installer for use with the ArcMC Node Management: arcmc-sw-
<build number>-remote.enc
l For ArcMC Appliance: arcmc-<build number>.enc
l ArcMC Agent Installer: The ArcMC Agent installer for all appliance nodes, and for some types
of software nodes, is bundled with the ArcMC installer file. You may remotely install or upgrade
the ArcMC Agent on a managed node directly from ArcMC, as follows:
l You can install or upgrade the ArcMC agent remotely from a managing ArcMC on all managed
appliance nodes (Logger Appliance, ArcMC Appliance, and Connector Appliance hardware
form factor).
l You can install or upgrade the ArcMC agent for remotely managed software nodes which are
ArcMC v2.1 and Logger v6.0 or later.

The ArcMC Agent cannot be upgraded or installed remotely on earlier versions of ArcMC and
Logger, nor for any software Connector Appliance managed node. For these node types, the
manual installer is required and named ArcSight-ArcMCAgent-2.6.<build
number>.0.bin.
ArcMC Appliance OS Upgrade Files
Available from the HPE download site, the OS upgrade files for ArcSight Management Center 2.6
Appliance (only) are named as follows:
l For Upgrade to RHEL 6.8: (C650x appliances) osupgrade-arcmc-rhel68-
<timestamp>.enc
l For Upgrade to RHEL 7.3: (C660x appliances) osupgrade-arcmc-rhel73-
<timestamp>.enc
For OS upgrade files for a software ArcMC host, contact your host vendor.
Prerequisite to Installation for RHEL 7.x
Before installing or upgrading software ArcMC on Red Hat Enterprise Linux (RHEL) 7.X, you must
modify the inter-process communication (IPC) setting of the logind.conf file.
To modify the logind.conf file for RHEL 7.X:
1. Navigate to the /etc/systemd directory, and open the logind.conf file for editing.
2. Find the RemoveIPC line. RemoveIPC should be active and set to no. ((Remove the # sign if
it is there, and change the =yes to =no if appropriate. The correct entry is: RemoveIPC=no).
3. Save the file.
4. From the /etc/systemd directory, enter the following command to restart the systemd-
logind service and put the change into effect: systemctl restart systemd-
logind.service
After you have modified this setting and met any other prerequisites, you are ready to install
software ArcMC.

Upgrading ArcMC
Upgrade is supported from software ArcSight Management Center version 2.5 or 2.5.1 to software
ArcSight Management Center 2.6. You should also upgrade any managed ArcMCs to version 2.6
as well.
Upgrade Prerequisites
Be sure that you meet these prerequisites before upgrading to ArcMC 2.6.
l ArcMC Appliance OS Upgrade: Upgrade the appliance OS to a supported OS version before
upgrading the ArcMC version.
Note: Because the latest OS includes important security updates, be sure to apply the OS
upgrade even if you already upgraded the OS to 6.8 or 7.3 for ArcMC 2.6.
OS support and required OS upgrade filenames are listed under Technical Requirements. For
instructions on how to apply the appliance OS upgrade locally, see Upgrading ArcMC.
Note: For OS upgrade files for a software ArcMC host, contact your host vendor.
These instructions are for upgrading software ArcMC using a wizard in GUI mode. You can also
upgrade your ArcMC from the command line in console mode, and in silent mode. For those
instructions, refer to the Installation chapter of the ArcMC Administrator's Guide.
Remote upgrade is another method if the target ArcMC is managed by another ArcMC using the
Node Management upgrade feature.
To upgrade to ArcSight Management Center 2.6 using the install wizard:
1. Copy the required upgrade files to a secure network location.
2. Run these commands from the directory where you copied the ArcSight Management Center
files:
chmod u+x ArcSight-ArcMC-2.6.<build number>.0.bin
./ArcSight-ArcMC-2.6.<build number>.0.bin
The installation wizard starts. Review the dialog box, and then click Continue.
3. Follow the prompts to upgrade. For your installation directory, choose your original ArcSight
Management Center installation directory.
4. If you run the ArcSight Management Center software installer as a root user, then you need
to specify an existing non-root user and a port through which ArcSight Management Center

users will connect. If any port other than 443 (the default HTTPS port) is specified, then
users will need to enter the port number in the URL they use to access ArcSight Management
Center. When prompted, enter the user name of the non-root user and the HTTPS port
number, and then click Next.
5. Follow the prompts to complete product initialization.
6. If you run the installer as a root user, specify whether to run ArcSight Management Center as
a system service or as a process.
Note: Additionally, a few libraries are added using ldconfig. For a complete list of
those libraries, see /etc/ld.so.conf.d/arcsight_arcmc.conf and <install_
dir>/current/arcsight/install/ldconfig.out.
The upgrade is completed.
7. Click Start ArcSight Management Now, or click Start ArcSight Management Center
later, and then click Finish.

Upgrading the ArcMC Agent
ArcSight Management Center 2.6 can only manage nodes that are running ArcSight Management
Center Agent version 2.6. Consequently, after upgrading to ArcSight Management Center 2.6,
you may also need to upgrade the ArcSight Management Center Agent on some or all previously
managed hosts in order to continue management.
An Agent upgrade is recommended for any of the following host types running ArcSight
Management Center Agent 2.0 or earlier that you wish to continue managing:
l Hardware Appliances: Hardware Connector Appliances, Logger Appliances, or ArcMC
Appliances
l Software Form Factors: Software Connector Appliances, Software Loggers, or software
ArcMCs
Agent Upgrade Procedure
ArcSight Management Center 2.6 can remotely upgrade the ArcMC Agent on any number of
managed hosts. For ArcMC Agent upgrade instructions, see the ArcSight Management Center
Administrator’s Guide.

Fixed Issues
This release of ArcMC includes the following fixed issues.
ARCMC-
9751
The Software Installation chapter of the 2.5 Administrator's Guide gives the incorrect syntax for
setting limits in /etc/security/limits.conf. This information is shown correctly in the 2.6 Administrator's
Guide.
ARCMC-
9741
On ArcMC 2.5 and 2.5.1, G8 appliances would longer respond to ICMP requests, such as ping requests.
This issue has been resolved.
ARCMC-
9695
When adding a connector to be managed by ArcMC 2.5, 2.5.1 license tracking for the day the connector
is added would incorrectly include all connector ingestion since the last up time for the connector and
could show spurious data spikes.
ARCMC-
9235
In some cases, filters would not work correctly under the Property column on the Consumption Report.
This issue has been resolved.
ARCMC-
9117
When ArcMC 2.5 enabled as ADP License Server was upgraded to ArcMC 2.5.1, the UI failed to display
the accurate license limit GB/day on license usage graph on the Dashboard or on License information
page under System Admin. This issue has been resolved.
ARCMC-
9005
In the Topology view, if a connector had another connector as a destination, any devices sending events
to the first connector would erroneously be shown as duplicate devices, shown sending events to the
destination connector.
ARCMC-
8975
In some cases, when ArcMC 2.5 was freshly deployed on a Gen9 appliance, the user had only access to
the System Admin Page.
ARCMC-
8781
In some cases, the topology view could be displayed twice.
ARCMC-
6502
When Logger Event Archives have long names, the name will no longer be displayed incorrectly.
ARCMC-
4077
In Internet Explorer 11, when selecting multiple rows with the mouse, the text in the rows also would also
be incorrectly highlighted.
ARCMC-
52
If pages were loaded in a small browser window, then maximizing the browser did not resize wizard
pages correctly.

Open Issues
This release of ArcMC contains the following open issues.
ARCMC-
11219
In some cases, a Kafka timeout causes an intermittent topic bootstrap failure. Because of this, route
creation in ArcMC may fail.
Workaround: Restart webservices on the Event Broker master node.
ARCMC-
11212
When using local authentication to log in, and the user checks the Forgot Password checklist, the
copyright statement is cut off. This issue only occurs in Chrome and Firefox.
ARCMC-
11174
In some cases, adding a G8 Logger 6.31 to ArcMC as a managed host may return an Error 500 Internal
Server Error.
Workaround: Modify the iptables to reject instead of drop packets to unused ports as follows:
1. Ensure that ssh access is enabled in System Admin
2. On the logger appliance host, run the following commands at the command line:
iptables --append INPUT -j REJECT --reject-with icmp-port-unreachable
ARCMC-
11140
When choosing "Export" from the Node Management menu while viewing a feature other than Node
Management, the page may be remain blank or show a spinner indefinitely, although the export will
succeed. To avoid this, choose the "Node Management" menu option first, and after the page has loaded,
choose "Export".
ARCMC-
11133
In the Topology View, the Event Broker destination for a managed Event Broker will appear to be
unmanaged.To view the Event Broker metric details page, on the Dashboard, click the EB Nodes tile at
the top of the page.
ARCMC-
11220
On a freshly imaged ARI for ArcMC 2.6, when you restart the web process for the first time, you will
have access to only System & Admin page and no access to navigational menus.
Workaround: If you have only access to System Admin page, restart the aps process on Process Status
page. Once aps process restarts and is running, restart the web process. You should now have access
to all menus.
ARCMC-
10797
On some L7600/C6600 appliances running RHEL 7.2, the OS was crashing or hanging.FIX: Applying the
RHEL 7.3 OS upgrade included with this release will upgrade the kernel to a more stable version.
ARCMC-
10736
An error can occur on Process Status page under System Admin after upgrading the version of RHEL
OS on an ArcMC appliance.
Please perform the following steps to resolve the issue:
1. SSH to the ArcMC Appliance
2. Execute the command : chattr -i /opt/local/monit/watchdog/insp.monitrc
3. Execute the command : rpm -e arcsight-nsp
4. Re-initialize the monit daemon: /opt/local/monit/bin/monit

ARCMC-
10478
After a product type ages out, the product type is permanently removed from ArcMC. To bring back
the device type, update the DB entry as follows.
Updating the DB directly to the existing entry:
Run the following:
On a Software arcmc:{install directory}/current/arcsight/bin/psql rwdb web
On an Appliance arcmc:{install directory}/local/pgsql/bin/psql rwdb web
Then run the sql:UPDATE arcmc_monitor_device_timeoutSET device_timeout='20', device_
tracking='t', device_ageout_days='13'WHERE device_product='<device product>';
Note: the device_timeout and device age_out parameters should be set to the desired valuestype q to
quiteRestart the web service after update.
ARCMC-
10355
In some cases, when an ArcMC has been upgraded from a connector appliance, only a limited selection
of destination types (3) is available. Workaound: Edit “agent.properties” and append a new destination
string (e.g: loggersecurepool, the string is dedicated for “logger secure pool” destination) to the end of
the entry of “transport.types”, and then restart the container. Note that when modifying agent.properties
to include the new destinations, those new destinations must be supported on the current container
build.
ARCMC-
10256
Only the 64-bit version of the Checkpoint OPSEC NG connector is supported on hardware series C6600.
ARCMC-
10178
Several ArcMC processes may be left running after the ArcMC appliance is stopped using monit.
ARCMC-
9287
ArcMC can be used to change the username used to authenticate to a connector. However, the new
value is merely stored in ArcMC and not actually changed on the connector.
ARCMC-
9225
Enabling the demo CA certificate fails when editing the destination from the Connector Summary ESM
destination in Node Management.Workaround: Perform the demo CA enablement operation by using
the Certificates button for selected connectors.
ARCMC-
8944
When platform:230 and platform:201 events are forwarded from Logger to an ESM manager, the device
host name and device address are converted to localhost and 127.0.0.1, respectively.
ARCMC-
7898
The Apache process fails to start if "Client Certificate" or "Client Certificate AND User Password" has
been enabled before Trusted Certificates are uploaded.Workaround: Apache will fail to start if the
Trusted Certificates directory is empty. Upload Trusted Client certificates in the System Admin >
Security > SSL Client Authentication > Trusted Certificates tab before enabling authentication methods
from the System Admin > Users/Groups > Authentication > External Authentication tab.
ARCMC-
7783
On the Monitoring page, Connector Count can take a long time to update. Please be patient while the
count is updated.
ARCMC-
6497
After adding a connector to a localhost container, listing all destinations to select from may take some
time. Please be patient while the list of destinations is built.

ARCMC-
4114
If the location of Logger nodes is updated, the new location will not be reflected in the path of the
Logger initial configuration source nodes.
ARCMC-
2783
Under Administration > Network > System DNS, the primary and secondary DNS should be set to 0.0.0.0
instead of letting them be empty fields. Setting the fields to an empty string causes issues with the DNS
provider.
ARCMC-
2129
In some circumstances, multiple copies of the same Content AUP file are created in the user/agent/aup
directory. This may cause large Appliance Backup files to accumulate.

Send Documentation Feedback
If you have comments about this document, you can contact the documentation team by email. If an
email client is configured on this system, click the link above and an email window opens with the
following information in the subject line:
Feedback on Release Notes (ArcSight Management Center 2.6)
Just add your feedback to the email and click send.
If no email client is available, copy the information above to a new message in a web mail client, and send
your feedback to arc-doc@hpe.com.
We appreciate your feedback!

ArcMC 2.6 Release Notes

More Related Content

What's hot (20)

Similar to ArcMC 2.6 Release Notes (20)

More from Protect724mouni (14)

Recently uploaded (20)

ArcMC 2.6 Release Notes