Arellia All Unclassified Applications filter being updated as part of Delta Collection Update schedule

book

Article ID: 158388

calendar_today

Updated On:

Products

Management Platform (Formerly known as Notification Server)

Issue/Introduction

The "All Unclassified Applications" filter contains all known file resources that do not have a security rating specified. In large scale deployments this filter can contain millions of resources. The filter is considered legacy and provided for backwards compatibility. Moving forward customers should use dynamic filters which scale to a better extent.

The Delta Collection Update schedule incorrectly identifies the All Unclassified Applications filter as being a candidate for delta updates. This can result in large processing time taken by the delta update as it evaluates every file resource for inclusion in the filter. The intended update cycle for the unclassified filter is only on the Always Update schedule which should fire once a day.

 

Note: content for this article was pulled from http://portal.arellia.com/wiki/display/KB/All+Unclassified+Applications+filter+being+updated+as+part+of+Delta+Collection+Update+schedule

Cause

Within the SMP the method DeltaCollectionUpdateSchedule.OnSchedule() indirectly calls the SQL stored procedure spDeltaCollectionUpdate which then calls spGetCollectionUpdateList to get the list of candidate filters and collections for delta update.

The issue arises due to bad logic in the SMP stored procedure spGetCollectionUpdateList which will include any collection in vCollection that is listed as a parent item reference in the ItemReference SQL table regardless of Hint type.

By adding the Hint types that Arellia uses in representing filter relationships into the CollectionUpdateHintExclusion table we effectively exclude Arellia filters that should not be updated on the delta update schedule (unless they are referenced by an active policy).

Resolution

Run the following SQL on the Symantec CMDB database to prevent SMP from incorrectly identifying Arellia filters as candidates for the delta update schedule.

INSERT INTO CollectionUpdateHintExclusion 
SELECT [str]
FROM fnListToTable('datasource,template', ',') f 
	LEFT JOIN CollectionUpdateHintExclusion c ON f.[str] = c.Hint 
WHERE c.Hint IS NULL