SCSP Event table is full and SCSP server is generating gigabytes of data transferred to SQL Server

Products

• Critical System Protection

Issue/Introduction

 - SCSP Event table (CSPEVENT) in the database is full (multi-million rows)

 - SCSP management server is sending about gigabyte of data per hour to the database server, causing bandwidth issues

 

Cause

When Event table is full, SCSP server will continually resend unprocessed data until accepted by the database server.

Resolution

The resolution is to reduce the size of the database and allow unprocessed data to complete.

1. Make database backup before performing any changes

2. In the SCSP manager, open the properties of each asset and check the “Deny Logs” option – this would help reducing the bandwidth load, by decreasing log bottleneck.
IMPORTANT: This checkbox should be cleared once the bandwidth issue is resolved.

3. In the SCSP manager, change “Purge Real-Time Events older than”. Set fair value for those fields based on your company policies (i.e. 90 days) - this would reduce the maximum number of events stored in the database

4. Change purge frequency setting in sis-server.properties. Indeed, the default purge frequency is 100,000 records/day, which is not enough to decrease fast enough the huge number of events stored in the database:

 - Stop SCSP Server service

 - On the management server, browse to c:\program files\symantec\critical system protection\server\tomcat\conf\sis-server.properties and open it in notepad

 - Look for a line: "#sisdbcleanup.runtime=23". Uncomment the line to read as follows: "sisdbcleanup.runtime=1" (this sets the purge frequency from 23 hours to every hour)

 - Find the line: "#sisdbcleanup.event.purge.limit=100000". Uncomment this line to read as follows: "sisdbcleanup.event.purge.limit=500000" (this sets the maximum number of events purged from 100000 to 500000)

 - Start SCSP Server service

This configuration change will now have the SCSP manager purging 12 million records/day rather than 100,000.

5. DBA should monitor Real-Time Events table daily for size (to ensure it is decreasing). Getting the table size below 8 GB would be ideal. DBA should also shrink the SCSPDBevents.ndf periodically.

 

Applies To

SCSP 5.2.8 with remote SQL Server database.