ArcSight ESM 7.

0(Compact mode)
This is installation guide for ArcSight ESM 7.0(Compact mode).
I hope this helps you.
----------------------------------
1. OS installation and network setting
cat /etc/os-release
cat /etc/redhat-release
CentOS Linux release 7.4.1708 (Core)
1.1 DATE & TIME
1.2 SOFTWARE SELECTION
- select "Basic Web Server"
- select "Compatibility Libraries"
- select "Development Tools"
- select "Done"
1.3 INSTALLATION DESTINATION
1.4 NETWORK & HOSTNAME
- select "ON" on the "Ethernet" part
- change "Host name"
- select "Done"
- select "Begin Installation"
1.5 USER SETTINGS
- ROOT PASSWORD
----------------------------------
2. network setting and config
- check lan card status
# nmcli d ---

extra - systemctl status NetworkManager

systemctl start NetworkManager
systemctl enable NetworkManager
nm-connection-editor
- check current network setting(ip, gateway, dns)
# nmcli dev show ensXXX
- setup network config(ip, gateway, dns)
# nmtui
   - select "Edit a connection" -> select "ensXX" 
   - (e.g.)IPv4 Address : 172.16.100.128/24, Gateway : 172.16.100.2, DNS servers : 8.8.8.8
- restart network service
# service network restart
----------------------------------
3. disable firewall

# systemctl status firewalld

# systemctl stop firewalld

# systemctl disable firewalld

# systemctl status firewalld

----------------------------------
4. disable SELinux
# cat /etc/sysconfig/selinux
  SELINUX=disabled

vi /etc/sysconfig/selinux
Save it :wq

----------------------------------
5. modify /etc/hosts
# cat /etc/hosts

# hostnamectl set-hostname correlator1.acme.com

# nmtui
Copy Software
Copy LIC

Rename it
Copy tzdata-2018e-3.el7.noarch

Copy ESM 7 software

(e.g.) 172.16.100.128  arcesm700
----------------------------------
6. Preparation of ESM installation //automation of arcsight user creatation and Uesr process
limit increase
- login user : root
- upload intallation file and license file to /tmp
# cd /tmp
# tar xvf ArcSightESMSuite-7.0.0.2208.0.tar
# cd Tools
# ./prepare_system.sh
# cd ..
# chown -R arcsight:arcsight *
# reboot
----------------------------------
7. Update of Time Zone Package
- upload "tzdata-2017c-1.el7.noarch.rpm" file to /tmp
# cd /tmp
# rpm -Uvh tzdata-2018e-3.el7.noarch.rpm
----------------------------------
8. modify logind.conf

After Patch Installation: RHEL 7.2 and 7.3 and CentOS 7.3
After applying the patch, if the postgresql service becomes unavailable, check this log file:

/opt/arcsight/logger/userdata/logs/pgsql/serverlog

for the following messages:

FATAL: semctl(2162718, 14, SETVAL, 0) failed: Invalid argument

FATAL: sorry, too many clients already

If you see these FATAL messages, perform the following steps:

1. As user root, edit the file /etc/systemd/logind.conf.

2. Search for RemoveIPC, and ensure there is only one instance of this property.
3. Edit the property if it exists (or add the property if it does not exist) to have the value
no:
RemoveIPC=no
4. Run this command:

systemctl restart systemd-logind.service

# vi /etc/systemd/logind.conf
- RemoveIPC=no  //remove "#" and save
# systemctl restart systemd-logind.service
----------------------------------
9. ESM Installation
** ESM installer must be own, and executed by arcsight user(not root)
- login user : arcsight
$ cd /tmp

$ ./ArcSightESMSuite.bin
Arcsight
If in case you’ll face below issue

Run below command

If in case you select YES
Click DONE
Via CLI only ( not required via GUI already done-> go to next step)
- execute "First Boot Wizard"
$ /opt/arcsight/manager/bin/arcsight firstbootsetup -boxster -soft -i console
----------------------------------
10. set up the services
- login user : root
# /opt/arcsight/manager/bin/setup_services.sh

----------------------------------
11. check status of services
$ service arcsight_services status
  aps service is available
  execprocsvc service is available
  logger_httpd service is available
  logger_servers service is available
  logger_web service is available
  manager service is available
  mysqld service is available
  postgresql service is available

----------------------------------
** You must modify the hosts file as shown below before connecting to the console.
  C:\Windows\System32\drivers\etc\hosts
(e.g.) 172.16.100.128  arcesm700
----------------------------------
The END.

Try ACC
Try again
ESM 7 Console setup
C:\arcsight\Console7
Connector installation. (ArcSight-7.8.0.8070.0-Connector-Win64)

C:\ESM 7\ESM 7 Software\Connector

C:\arcsight\connector7\current