Video Screencast Help
Search Video Help Close Back
to help
New in the Rewards Catalog: Vouchers for "Symantec Technical Specialist" and "Symantec Certified Specialist" exams.

How to purge more than 100000 events per 24 Hours in SCSP

Updated: 14 Dec 2009
arikar's picture
0 0 Votes
Login to vote

Hi…
As it seems when configuring on the SCSP Management console to purge the Real-Time events, the system only purges 100,000 events per day by default.
This means if you have 200,000 events per day then your DB will start growing by 100,000 events every day which is approximately 200MB a day.
As it seems it is some kind of a small annoying bug which can easily be fixed:
1.    Go to services .msc on the Management Servers and stop the " Symantec Critical System Protection Server" service.
2.    Go to C:\Program Files\Symantec\Critical System Protection\Server\tomcat\conf
3.    Backup the file: sis-server.properties (make a copy of it)
4.    Remove the read only permissions from the file: sis-server.properties
5.    Open the file with notepad
6.    Remove the hash from the two lines:     #sisdbcleanup.runtime=23
                                                                               #sisdbcleanup.event.purge.limit=100000
7.    Change the: "sisdbcleanup.runtime" to 4, 5 or another number (keep it within a reasonable figure  because this number creates a query in the SQL DB.
8.    Change the: "sisdbcleanup.event.purge.limit" to 200,000 (recommended).
9.    Save the file and exit.
10.    Put back the read only permission on the file properties.
11.    Start the " Symantec Critical System Protection Server" service.
12.    On the SCSP Manager go to: Master View Assets- Network Virtual Agents
13.    Click on your SCSP-Manager and click on the "Recent Events" tab. Within the next few hours you will see new event with the new options you specified.
14.    You're Done!