Pre-Migration Check - Incident Folder/Directory

Products

• Data Loss Prevention

Issue/Introduction

What happens when migration occurs when there are *.bad files or unprocessed *.inc files in the incident folder/directory?

Cause

Part of the Migration Process is to identify then copy incidents to the new version location.

Resolution

To help assure a clean migration, please address any *.bad files before proceeding with the migration process.

• Not doing so can introduce long delay times during migration and/or prevent a clean migration.

Ultimately, determining whether to delete or retain the files is a business decision but here are some items to help you make that determination.

1. Check the current version's incident folder. 
2. Identify if any incident files should be moved and/or deleted prior to the migration.
   1. *.INC files
      1. Minor version upgrades do not impact incidents.
         1. A minor version upgrade, for example, would 15.7 to 15.8 or any MP upgrades between those minor versions. 
      2. The migration will manage the move to the new directory.
         1. These incidents will process after the upgrade and services are restarted.
   2. *.BAD files
      1. These files should be moved and/or deleted PRIOR to the migration process.
         1. For more information on how *.bad files are caused, see the link below.
      2. Determine whether you will move the files and later rename to *.inc files or delete the *.bad files.
         1. Moving the files means you may choose to reintroduce into the incident folder, rename and attempt to be processed.
            
            1. For more information on reintroducing *.bad files, see the link(s) below.
         2. Deleting files is a permanent solution, but in many cases, *.bad files will be unprocessable.
         3. Some key factors to consider for deletion.
            1. Aging of *.bad files
               1. Depending on your remediation cycles, older incidents will not be addressed.
            2. Size of *.bad files
               1. Is there adequate space to store them in a different location?
            3. Quantity of *.bad files
               1. If there is a large number of files, all dated the same, was there an event that likely corrupted incidents, etc.
               2. How long will it take to move the number of files?
               3. Again, if these are aged files in large quantities, these are unlikely to be viable incidents.
      3. Test a few by changing to *.inc files.
         1. If they revert to *.bad, they are likely unusable.

Additional Information

What is a *.bad file? https://knowledge.broadcom.com/external/article/159855/what-is-a-bad-file.html

Changing all .bad incidents to .idc on a Windows operating system https://knowledge.broadcom.com/external/article?articleId=163644

You need to change all .bad incident files to .idc on a RedHat Linux Enforce Server https://knowledge.broadcom.com/external/article?articleId=163638