Unable to load a Log Source or Database in Reporter

Products

• Reporter-S500
• Reporter
• Reporter-VA

Issue/Introduction

Reporter database(s) stopped processing new access logs. Log sources are not loading.

Environment

Reporter version 11.x

Management Center 3.3.x or 4.1.x with the RPAC (Reporter Admin Console) package

Cause

The Reporter disk usage is above the critical threshold of 98%. 

Resolution

To remedy this issue in the short-term:

1. Delete any processed logs 
2. To prevent more disk space utilization, if the "post action" is set to move the processed log to ".DONE" or move to another location in Reporter, change the "post action" to Delete.
3. Remove older databases by shortening the expiry period (e.g. from 90 days to 30 days or from 30 days to 15 days) then execute "expire now" on the databases that have exceeded the expiry period. See Managing Existing Reporter Databases.

To remedy this issue in the long-term:

1.  Setup another file server where EdgeSWGs (ProxySGs) can use offloading their Access logs.
2.  From Reporter, configure a FTP log source that points to your new file server.  

Benefits of setting up the long-term solution:

• Avoids disk usage of database (processed logs) and access logs (unprocessed) local to the Reporter .   
• In the event of Reporter crash, the raw access logs are located on another file server are preserved and can be reprocessed if needed.  

Additional Information

To view the Reporter Event log from RPAC, navigate to Administration > System Information > System Event Log. Scroll to the bottom of the event log or click on the "DATE" header to arrange the log's timestamp from newest to oldest.

To view disk space utilization from RPAC, navigate to Administration > System Information > System Diagnostics > System Resources.