cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

SIEM upgrade 9.5.1 --> 9.5.2 - DBCheck issue

I'm wanting to use DBCheck to verify the DB is Ok before performing an ESM upgrade. In times past cd /usr/local/ess/data then DBCheck -d '/usr/local/ess/data/ngcp.dfl|127.0.0.1|1111' –c did the trick. However, since 9.5.1 running this command gives "...Not Ok: File/Table in use by another process (135)" for virtually all tables. Did a quick Google and KB86564 says to stop the cpservive then dbserver services then run the DBCheck command. Doesn't work, I see "Connection lost or not made (142)".

Can anyone help me here? Would prefer to know the DB is in an OK state prior to upgrading.

5 Replies
davidp64
Level 9
Report Inappropriate Content
Message 2 of 6

Re: SIEM upgrade 9.5.1 --> 9.5.2 - DBCheck issue

Hello Mark,

please follow the given cmd:

>>ps aux |grep cpservice

>>Kill the process

Restart the cpservice..after that take a reboot..

.....David

Re: SIEM upgrade 9.5.1 --> 9.5.2 - DBCheck issue

Hi David

Thanks for your reply.

Ran ps aux |grep cpservice, killed the cpservice process, ran DBCheck and got the "connection lost or not made" error.

Restarted cpservice, ran DBCheck again and got the "...Not Ok: File/Table in use by another process (135)" message again.

Rebooted the ESM (this is my lab combo box I'm testing before upgrading a client's environment - separate components). Same messages.

Anything else I can try?

andy777
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 4 of 6

Re: SIEM upgrade 9.5.1 --> 9.5.2 - DBCheck issue

DBCheck isn't mentioned in the release notes as part of the upgrade process and generally should not be used unless instructed by support. The database will tell you if it's "Not OK". in the System Status if there is a problem. If there is a concern for unbalanced tables then I recommend opening a ticket however this won't impact the upgrade process. Assuming your box is still working, I would proceed with the upgrade and monitor for anomalies.

Also, the command to restart cpservice is "service -f cpservice", or just type 'reboot'. It might take some time, but it will be less than the time it would take to rebuild the tables from a dirty shutdown. I wouldn't kill a process unless I was prepared for data corruption.

Re: SIEM upgrade 9.5.1 --> 9.5.2 - DBCheck issue

Thanks, Andy.

When did that upgrade process change? AFAIK DBCheck and other database/storage checks as per ESMUpgradeChecklist-RevB.pdf were still recommended in 9.5.0. Are any of those checks required now?

Anyway, upgrade proceeding as I type...

rgarrett
Level 9
Report Inappropriate Content
Message 6 of 6

Re: SIEM upgrade 9.5.1 --> 9.5.2 - DBCheck issue

They were removed from 9.5.2 RN.  Primary reason was that the tools is primarily a support tool, and used incorrectly, can cause database issues

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community