Tenable LCE 5.x / 5.1.x – Archive Repo Missing

Hey,

for some reason Tenable as no Community/KB Articles about the Troubleshooting of the Elastic Stack used in the 5.x branch of LCE so I want to share what i learned today and make it google serachable as a solution:

Due to a disk fillup i was presented with a LCE in version 5.1.1 that was logging:

Apr 03, 20 07:19 (siloMinder) WARN (trim-activeDb.cpp:285,archiveSilo) - Received an error (code 404) response: {
    "status": 404,
    "error": {
        "reason": "[archive_repo] missing",
        "type": "repository_missing_exception",
        "root_cause": [
            {
                "reason": "[archive_repo] missing",
                "type": "repository_missing_exception"
            }
        ]
    }
}

Basically the archive Repository structure of elastic was broken and thus the cleanup/disk trimming was not working anymore potentially leading to a predetermined diskfillup (again).

After the helpfull tip of a fellow guardian I found all the Elastic Troubleshooting scripts under /opt/lce/tools/es-helper-scripts

Including the script register-archiveDb:

# ./register-archiveDb

USAGE: ./register-archiveDb <absolute path of archiveDir> | --deregister

A simple new registration of the archive path solved the issue and a new Archiving structure was created.

So I hope this post will help at least one other fellow person in need to rescue their LCE! :)

Stay sane during these Corona Days guys!

BR
Sebastian

About SebastianB

read it in my blog
This entry was posted in tenable and tagged , , . Bookmark the permalink.