Automated purge does not purge all incidents

Products

• Security Information Manager

Issue/Introduction

Symptoms
2008-10-22 00:58:11,680 43271569 [DBMU-26] DEBUG com.symantec.sim.simdb.ManagerImpl - Not running blocked job "Incidents Health Maintenance" as its locks are still not available

2008-10-22 01:00:11,608 43391497 [DBMU-15] INFO com.symantec.sim.simdb.ManagerImpl - Blocking job "Purge Incidents" as its locks are not available
2008-10-22 01:00:11,608 43391497 [DBMU-15] WARN com.symantec.sim.simdb.ManagerImpl - Job ID 25 does not exist. Not running job.
2008-10-22 01:00:11,608 43391497 [DBMU-27] INFO com.symantec.sim.simdb.jobimpl.JobTracker - Running job "Purge Event Data"

Cause

If a service has been down for an extended period of time and the archive is more than 95% full the automated purge may not perform as expected.

Resolution

The incident database may be too full to process automatically. Purging a small set of events may allow it to function normally.
Manually purge the incidents then restart the SSIM.

1. Log in to the SSIM Web configuration page as administrator
2. Click Database Utilities
3. Click Purge
4. Enter settings that will purge some of the desired events or incidents
5. Queue the purge by clicking Purge

You may have to restart the SSIM for it to process the purge, if this is the case it will take additional time to restart.

If this process fails, select a smaller group of incidents or events to purge manually.