Compatibility between SSIM SCSP collector and new version of SDCS

book

Article ID: 169992

calendar_today

Updated On:

Products

Security Information Manager Data Center Security Server Data Center Security Server Advanced

Issue/Introduction

Is the Symantec Security Information Manager (SSIM) Symantec Critical Systems Protection (SCSP) collector compatible with Symantec Data Center Security Server (SDCS) 6.X versions?

Resolution

The SSIM collector that was designed to pull events from SCSP is not compatible with any of the SDCS 6.x versions.

 

The SSIM collector does not have NOLOCK in the query that is run on the database and will lock the events table when ran.  This will cause performance issues with the SDCS product. While the events table is locked no new agents or new events can be added to the database and the purge process may not complete. 

The schema of the SDCS 6.x databases was updated from versions of SCSP and will not get all the information that was previously gathered from SCSP as well has some information in the wrong fields.

The SCSP collector is not aware of the partitioning that is configured with SQL Enterprise databases in SDCS 6.7 and will stop the partition management features used by SDCS to control the database size.