Data Loss Prevention

 View Only
  • 1.  Enforce does not delete old incidents.

    Posted Dec 06, 2015 12:20 PM

    Enforce server does not delete old incidents. My system is configured for storage of incidents 180 days. I create 26 tablespace LOB_tablespase. My oradata is 800GB. Old incidents not delete of tablespace. But Enforce server old incidents do not show. 

    Help me please.

     



  • 2.  RE: Enforce does not delete old incidents.

    Posted Dec 07, 2015 02:04 AM

    Please check if the following article is of any help.

    Archiving incidents



  • 3.  RE: Enforce does not delete old incidents.

    Trusted Advisor
    Posted Dec 07, 2015 02:38 AM

    hello,

    Even when incident are deleted oracle does not release empty space in tablespace so that why you see a permanent increase even when you delete incident. But empty space will be reused by oracle to store new incident so your tablespace should grow up slowlier after a massive incident deletion.

     You should ask your database administrator if you want to release empty space in oracle tablespace (it seems to me there is some oracle command to do it but not sure).

     

     Regards



  • 4.  RE: Enforce does not delete old incidents.

    Posted Dec 07, 2015 08:50 AM

    There are two aspects to this question:

    1.) regaining space for re-usability (new incidents, etc,) & 2.) actual database file size reduction.

    1.) regaining space for re-usability (new incidents, etc,):

    Re-gaining file is simple

    - you delete incidents and all data associated with it from Enfoce UI.

     - bydefault, at mid-night the actual deletion from the Oracle Database takes place.
    You can see the status on the System > Incident Data > Incident Deletion.

     - Once deletion task run is done, you should be able to re-use all that space you regained.

    - This can be validated by several scripts/sqlplus commands where actual free space would be visible

    2.) actual database file size reduction

    After performing incident deletion, and validating deletion under System > Incident Data > Incident Deletion you are required to perform a complete DB upload reload process. Basically create a new DB file. The standard way DBAs do this is normally copy all tables to a different temp database and recopy it back to the original file. This releases DB space.

     



  • 5.  RE: Enforce does not delete old incidents.

    Posted Dec 07, 2015 11:31 AM
      |   view attached
     
    For clarity, I attach a log file. I am very concerned that's the part of the log file. If this ever an error 1802.
    01 дек 2015 00:01:44,380- Thread: 81 INFO [com.vontu.manager.system.incident.deletion.IncidentDeletionTask$IncidentDeletorStoredProcedureWrapper] (MANAGER.302) The system will periodically delete stale Discover incident connection records. A connection record is stale when it is older than 180 days, a period determined by the com.vontu.manager.system.IncidentDeletion.StaleStorageConnectionRecordAgeInDays property in Manager.properties.
    01 дек 2015 00:01:44,403- Thread: 81 INFO [com.vontu.manager] Incident deletion started. Incident deletion started
    01 дек 2015 00:01:44,865- Thread: 78 INFO [com.vontu.manager.system.statistics.StatisticsRollupTask] Summarization complete
    01 дек 2015 00:02:44,392- Thread: 81 INFO [com.vontu.manager] Incident deletion completed. Incident deletion ran for 41 second(s) 0 ms and deleted 0 incident(s)
    01 дек 2015 01:01:56,406- Thread: 82 INFO [com.vontu.manager] Endpoint Data deletion task finished in 11 second(s) 571 ms
    What teams can be viewed actual free space in the database?
    I want the system to be autonomous , for that I have allocated for the database 1TB.

    Attachment(s)

    rar
    1.rar   4 KB 1 version


  • 6.  RE: Enforce does not delete old incidents.

    Posted Dec 07, 2015 11:33 AM
     
    For clarity, I attach a log file. I am very concerned that's the part of the log file. If this ever an error 1802.
    01 дек 2015 00:01:44,380- Thread: 81 INFO [com.vontu.manager.system.incident.deletion.IncidentDeletionTask$IncidentDeletorStoredProcedureWrapper] (MANAGER.302) The system will periodically delete stale Discover incident connection records. A connection record is stale when it is older than 180 days, a period determined by the com.vontu.manager.system.IncidentDeletion.StaleStorageConnectionRecordAgeInDays property in Manager.properties.
    01 дек 2015 00:01:44,403- Thread: 81 INFO [com.vontu.manager] Incident deletion started. Incident deletion started
    01 дек 2015 00:01:44,865- Thread: 78 INFO [com.vontu.manager.system.statistics.StatisticsRollupTask] Summarization complete
    01 дек 2015 00:02:44,392- Thread: 81 INFO [com.vontu.manager] Incident deletion completed. Incident deletion ran for 41 second(s) 0 ms and deleted 0 incident(s)
    01 дек 2015 01:01:56,406- Thread: 82 INFO [com.vontu.manager] Endpoint Data deletion task finished in 11 second(s) 571 ms
    What teams can be viewed actual free space in the database?
    I want the system to be autonomous , for that I have allocated for the database 1TB.


  • 7.  RE: Enforce does not delete old incidents.

    Trusted Advisor
    Posted Dec 08, 2015 02:25 AM

    hello

     

    May i miss some point. You wrote in your first post that "My system is configured for storage of incidents 180 days", how did you schedule that ?

     

    If you have enough space available on your database system, you could also define your tablespace in autoincrement mode, which means that automatically oracle will

    take more space if needed (of course you have to monitor tablespace size) or monitor DLP event about tablespace size (2301)

    Regards



  • 8.  RE: Enforce does not delete old incidents.

    Posted Dec 08, 2015 06:00 AM

    Hello,

    I configurete *.conf for storage of incidents 180 days. On the average 3000 incidents per day.

    monitor tablespace size show me 99.9 percent usage. 

    What is autoincrement mode? How can i do this?

     

    Senk

    Best Regards