SCSP Event table is full and SCSP server is generating gigabytes of data transferred to SQL Server

Article:TECH196835  |  Created: 2012-09-18  |  Updated: 2012-10-05  |  Article URL http://www.symantec.com/docs/TECH196835
Article Type
Technical Solution

Product(s)

Environment

Issue



 - SCSP Event table (CSPEVENT) in the database is full (multi-million rows)

 - SCSP management server is sending about gigabyte of data per hour to the database server, causing bandwidth issues

 


Environment



SCSP 5.2.8 with remote SQL Server database.

 


Cause



When Event table is full, SCSP server will continually resend unprocessed data until accepted by the database server.


Solution



The resolution is to reduce the size of the database and allow unprocessed data to complete.

1. Make database backup before performing any changes

2. In the SCSP manager, open the properties of each asset and check the “Deny Logs” option – this would help reducing the bandwidth load, by decreasing log bottleneck.
IMPORTANT: This checkbox should be cleared once the bandwidth issue is resolved.

3. In the SCSP manager, change “Purge Real-Time Events older than”. Set fair value for those fields based on your company policies (i.e. 90 days) - this would reduce the maximum number of events stored in the database

4. Change purge frequency setting in sis-server.properties. Indeed, the default purge frequency is 100,000 records/day, which is not enough to decrease fast enough the huge number of events stored in the database:

 - Stop SCSP Server service

 - On the management server, browse to c:\program files\symantec\critical system protection\server\tomcat\conf\sis-server.properties and open it in notepad

 - Look for a line: "#sisdbcleanup.runtime=23". Uncomment the line to read as follows: "sisdbcleanup.runtime=1" (this sets the purge frequency from 23 hours to every hour)

 - Find the line: "#sisdbcleanup.event.purge.limit=100000". Uncomment this line to read as follows: "sisdbcleanup.event.purge.limit=500000" (this sets the maximum number of events purged from 100000 to 500000)

 - Start SCSP Server service

This configuration change will now have the SCSP manager purging 12 million records/day rather than 100,000.

5. DBA should monitor Real-Time Events table daily for size (to ensure it is decreasing). Getting the table size below 8 GB would be ideal. DBA should also shrink the SCSPDBevents.ndf periodically.

 





Article URL http://www.symantec.com/docs/TECH196835


Terms of use for this information are found in Legal Notices