Running Large or Complex Reports

A very large report (for example, a 500 MB PDF report) might require so much virtual machine (VM) memory that it can cause the ArcSight Manager to crash and re-start. To prevent this scenario, you can set up the Manager to expose a special report parameter for generating the report in a separate process. The separate process has its own VM and heap, so the report is more likely to finish. Even if the allocated memory is still not enough, the report failure will not crash the Manager. This option must be set up on the Manager to expose it in the ArcSight Console report parameters list.

The default server property is report.canarchivereportinseparateprocess=false. You need to change this to true.

The steps are as follows:

  1. Refer to the ESM Administrator’s Guide. In the Configuration chapter, follow the instructions in the topic on Managing and Changing Properties File Settings, Editing Properties to add the property. Make sure to restart the Manager after making changes.

    After setting the property to true, you will now have the ability to set the report parameter on the ArcSight Console.

  2. On the ArcSight Console, open the report that you want to run in a separate process in the Report Editor, and click the Parameters tab. Set the parameter Generate Report In Separate Process to true.

  3. Run the report. The report should run like a normal report, but it does not consume the resources of the Manager VM. See notes below for more information.

    Tip: Here are more tips about the property described in this topic.

    • If a report is saved with the parameter set to true, the report is archived as a separate process even if the property report.canarchivereportinseparateprocess in server.properties is set back to false later on.

    • This property indicates whether reports are allowed to be archived in a separate process. When this property is set to true, the option to run and archive the report in a separate process is available in the common properties in the Report Editor. Setting the value to true causes the report to be archived in a separate process. The benefit of archiving a report in a separate process is to avoid consuming Manager resources and potentially crashing the Manager.

    • Use this parameter only in special circumstances as needed. For example, if archiving a report is causing the Manager to crash then you might apply this solution. Generally, if a report contains tables that have more than 500,000 rows with 4 or 5 columns per row it is likely that the report is large enough over-tax the Manager VM memory. However, the threshold may vary depending on the Manager heap size and the details and data in the tables so it is best to only resort to this solution if you encounter problems archiving a particular report.