How to purge more than 100000 events per 24 Hours in SCSP
Hi…
As it seems when configuring on the SCSP Management console to purge the Real-Time events, the system only purges 100,000 events per day by default.
This means if you have 200,000 events per day then your DB will start growing by 100,000 events every day which is approximately 200MB a day.
As it seems it is some kind of a small annoying bug which can easily be fixed:
1. Go to services .msc on the Management Servers and stop the " Symantec Critical System Protection Server" service.
2. Go to C:\Program Files\Symantec\Critical System Protection\Server\tomcat\conf
3. Backup the file: sis-server.properties (make a copy of it)
4. Remove the read only permissions from the file: sis-server.properties
5. Open the file with notepad
6. Remove the hash from the two lines: #sisdbcleanup.runtime=23
#sisdbcleanup.event.purge.limit=100000
7. Change the: "sisdbcleanup.runtime" to 4, 5 or another number (keep it within a reasonable figure because this number creates a query in the SQL DB.
8. Change the: "sisdbcleanup.event.purge.limit" to 200,000 (recommended).
9. Save the file and exit.
10. Put back the read only permission on the file properties.
11. Start the " Symantec Critical System Protection Server" service.
12. On the SCSP Manager go to: Master View Assets- Network Virtual Agents
13. Click on your SCSP-Manager and click on the "Recent Events" tab. Within the next few hours you will see new event with the new options you specified.
14. You're Done!