Several questions:

- What version of CCS?
- What is doing the data collection? (CCS managers, ESM or RMS?)
- What kinds of data collection? (predefined standards, custom standards, queries ?)
- you didn't change the CCS App server's domain membership, did you? (you can't)

That should be good enough to get us started :)

Sebastien,

It depends on what query you are running.
In my experience, if you are running a windows users query, it is best to scope it to only one domain controller instead of scoping it to the entire domain.

If the query is scoped to the entire domain, it is going to query each and every machine in that domain - thus taking longer.
If the same query is scoped to only one DC - it finishes in one to 5 mins max.

Thanks,
Chaitali

Hi,

and thanks for your time.

I use CCS11 with CCS Managers for data collection. I try to collect data for only 1 windows asset in the same  domain as my servers, and use the predefined windows standard (also tried with custom standards)

yesterday, one collection took 3hours to be completed... (for information, I have the same type of installation in my Dev environment, and don't have any issue)

the only thing who was my servers were not using the right domain controller for login at the first stage, but it has been corrected.

I cleared the domain cache by removing the files  for the windows assets in symantec\xxx\control\windows\cache\* and rebooted the servers, but apparently I still see thousands of blade.workerprocess packets during data collection to the wrong domain controller. is it hardcoded somewhere else ??

I also have a case opened to symantec, but I really get crazy with this performance issue and time is running :(

When you say "my servers were not using the right domain controller for login at the first stage", do you mean your LDAP settings in Settings>General? Or, something else in CCS? On the Windows box?

Just answer that and we can go from there.

My servers were using a wrong Domain controller site when you logged in to it. (so windows box)

but when you collect data, and build the cache, ccs needs some credentials who tries to reach a domain controller, which is not the right one (even after having  modified the preferred domain controller to use in windows, and cleared the cache)

when I sniff the traffic from the CCS Manager data collector server I see :

process name / source / dest / payload

blade.workerprocess.exe / ccs-manager-hostname / wrong-ldap-server-hostname / ldap(389)-xxxxxxx

this wrong-ldap-server-hostname is a ldap(domain controller) server my ccs manager must not try to reach as it is not in the same subnet, but I'm not able to change it. (even if I remove the cache files)

thanks.

Do you have a query engine installed on this wrong LDAP domain controller?

did you change the domain membership of the CCS application server?

you can always edit the hosts file and point "wrong-ldap-server-hostname" to "right-ldap-server-hostname"...