cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
jyadav
Level 7
Report Inappropriate Content
Message 1 of 6

NotOk not running elmd,elmjobsdctl,elminputdctl,elmcompressctl,elmifrecyclectl,ELM FTI change is progress

Hi,

I a getting the below status on ELM health;

NotOk not running elmd,elmjobsdctl,elminputdctl,elmcompressctl,elmifrecyclectl,ELM FTI change is progress

We just has changed the drive from one RAID array which had been degraded a time before.

5 Replies

Re: NotOk not running elmd,elmjobsdctl,elminputdctl,elmcompressctl,elmifrecyclectl,ELM FTI change is progress

Hi jyadav,

I am getting the same error.

Could you solved the problem? If yes, How?

Best Regards,

Cagatay Kacar

kwharris
Level 7
Report Inappropriate Content
Message 3 of 6

Re: NotOk not running elmd,elmjobsdctl,elminputdctl,elmcompressctl,elmifrecyclectl,ELM FTI change is progress

Have you tried typing "NitroStarted" on the console # prompt (e.g. <HOSTNAME>#) this will give you the status of the ESM.  Then you can type "NitroStart --nod" to restart the ESM, then tail the /var/log/messages file to review the progress and/or errors.

Re: NotOk not running elmd,elmjobsdctl,elminputdctl,elmcompressctl,elmifrecyclectl,ELM FTI change is progress

After nearly two years since posting, I'm marking the OP's post as "Assumed Answered".

---

Peter

Moderator

Re: NotOk not running elmd,elmjobsdctl,elminputdctl,elmcompressctl,elmifrecyclectl,ELM FTI change is progress

I solved the problem for now. I stopped and startted  the Receiver from ESM console. The problem is gone. But I couldnt find the real reason for that.

How did this happend;

I added the DNS client as log source via v10 SIEM collector. v10 works 8081 port  on default (MEF port). I changed the port on collector and ESM console(log source list- interface)

That error showed up.

Regards,

Cagatay Kacar

Re: NotOk not running elmd,elmjobsdctl,elminputdctl,elmcompressctl,elmifrecyclectl,ELM FTI change is

Did you verified the space allocated to ELM raw logs?

According to KB91580 "...the ELM management database has grown and exceeds the available capacity in the storage device to which it is allocated. To prevent data loss, the ELM stops services when free space is less than 105 GB and restarts when free space is greater than 125

To confirm that low disk space caused the issue, use the following command to get the path (location) of the ELM management database:

#grep path /etc/NitroGuard/mgtdbloc.conf

path=/elm_allocations/MGTDB_ALLOCATION_20190531060606/mgtdb

 
After you identify the path, use the following command to examine disk space on the drive:
 

#df -h /elm_allocations/MGTDB_ALLOCATION_20190531060606/mgtdb

Filesystem      Size  Used Avail Use% Mounted on
/dev/md6        493G  388G  100G  80% /elm_allocations/MGTDB_ALLOCATION_20190531060606

NOTE: If the amount of free space is under 105 GB, the ELM management database stops."

 

Hope this help you!

 

Emil MIHAI

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community