DCS/CSP Agent logs are almost consuming all disk space

Products

• Critical System Protection
• Data Center Security Server
• Data Center Security Server Advanced

Issue/Introduction

DCS/CSP Agent has been installed. After a while, you notice a lot of zip files are consuming all disk space. These files are stored in one of the following folder(s):

DCS
 => /var/log/sdcsslog/archive (UNIX)
 => C:\Program Files\Symantec\Data Center Security Server\Agent\sdcsslog (Windows 32bit)
 => C:\Program Files (x86)\Symantec\Data Center Security Server\Agent\sdcsslog (Windows 64bit)

CSP
 => /var/log/scsplog/archive (UNIX)
 => C:\Program Files\Symantec\Critical System Protection\Agent\scsplog (Windows 32bit)
 => C:\Program Files (x86)\Symantec\Critical System Protection\Agent\scsplog(Windows 64bit)

 

Environment

Data Center Security - 6.x.x

Critical System Protection - All Versions

Cause

There may be two reasons these logs remain on the Agent:

This is located in the Java Console, under Configs, "Default Common Parameters" for both Prevention and Detection. Within the "Default Common Parameters" the option is set under the "Logging" tab.

1. 'Delete log files after processing' option has not yet been configured. 

2. 'Delete log files after processing' option has configured and recently applied to agent, however it does not impact older logs

 

Resolution

1. Configure the "Logging" settings in DCS or CSP console, and the reapply the modified "Security Group" in DCS or Asset Group in CSP.
NOTE: You will need to modify the Prevention and Detection "Default Common Parameters"

2. You can then manually delete/archive scsplog folder content

Applies To - All DCS/CSP Agent's

DCS Prevention

DCS Detection



CSP