cancel
Showing results for 
Search instead for 
Did you mean: 

SIEM upgrade 9.5.1 --> 9.5.2 - DBCheck issue

I'm wanting to use DBCheck to verify the DB is Ok before performing an ESM upgrade. In times past cd /usr/local/ess/data then DBCheck -d '/usr/local/ess/data/ngcp.dfl|127.0.0.1|1111' –c did the trick. However, since 9.5.1 running this command gives "...Not Ok: File/Table in use by another process (135)" for virtually all tables. Did a quick Google and KB86564 says to stop the cpservive then dbserver services then run the DBCheck command. Doesn't work, I see "Connection lost or not made (142)".

Can anyone help me here? Would prefer to know the DB is in an OK state prior to upgrading.

5 Replies

Re: SIEM upgrade 9.5.1 --> 9.5.2 - DBCheck issue

Hello Mark,

please follow the given cmd:

>>ps aux |grep cpservice

>>Kill the process

Restart the cpservice..after that take a reboot..

.....David

Re: SIEM upgrade 9.5.1 --> 9.5.2 - DBCheck issue

Hi David

Thanks for your reply.

Ran ps aux |grep cpservice, killed the cpservice process, ran DBCheck and got the "connection lost or not made" error.

Restarted cpservice, ran DBCheck again and got the "...Not Ok: File/Table in use by another process (135)" message again.

Rebooted the ESM (this is my lab combo box I'm testing before upgrading a client's environment - separate components). Same messages.

Anything else I can try?

McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 4 of 6

Re: SIEM upgrade 9.5.1 --> 9.5.2 - DBCheck issue

DBCheck isn't mentioned in the release notes as part of the upgrade process and generally should not be used unless instructed by support. The database will tell you if it's "Not OK". in the System Status if there is a problem. If there is a concern for unbalanced tables then I recommend opening a ticket however this won't impact the upgrade process. Assuming your box is still working, I would proceed with the upgrade and monitor for anomalies.

Also, the command to restart cpservice is "service -f cpservice", or just type 'reboot'. It might take some time, but it will be less than the time it would take to rebuild the tables from a dirty shutdown. I wouldn't kill a process unless I was prepared for data corruption.

Re: SIEM upgrade 9.5.1 --> 9.5.2 - DBCheck issue

Thanks, Andy.

When did that upgrade process change? AFAIK DBCheck and other database/storage checks as per ESMUpgradeChecklist-RevB.pdf were still recommended in 9.5.0. Are any of those checks required now?

Anyway, upgrade proceeding as I type...

Re: SIEM upgrade 9.5.1 --> 9.5.2 - DBCheck issue

They were removed from 9.5.2 RN.  Primary reason was that the tools is primarily a support tool, and used incorrectly, can cause database issues