Update LDW_Core runs long with web activity events integrated

Products

• Information Centric Analytics

Issue/Introduction

After integrating a web activity events data source in Information Centric Analytics (ICA) - for example, Symantec Cloud SWG events through ICA's Symantec WSS Import Utility - the nightly RiskFabric Processing job runs exceptionally long on the Update LDW_Core step (11).

Querying the Log_DataTransformation table in the RiskFabric relational database shows the currently running process is 'Find events with unusual web activity' by the stored procedure spLDW_UpdateEventDetail in which it is inserting rows into the temp table #tempUnusualWebActivity.

Environment

Version : 6.6.x

Component : RiskFabric Processing

Resolution

A performance enhancement to address this condition will be released in ICA 6.7.

Additional Information

To query the Log_DataTransformation table in order to determine whether your environment is affected by the symptoms described in the Introduction section of this article, follow this procedure:

1. Open SQL Server Management Studio (SSMS)
2. Connect to the Database Engine hosting the RiskFabric relational database
3. From the File menu, select New > Query with Current Connection
   A query editor window opens
4. Copy the following query and paste it in the query editor window:
   

   USE RiskFabric;
   GO
   
   SELECT   TOP 10
            LogDescription,
            StoredProcedureName,
            DestinationTableName,
            StartDate
   FROM     dbo.Log_DataTransformation WITH (NOLOCK)
   WHERE    StatusFlag = N'R'
   ORDER BY LogID DESC;

5. Execute the query by pressing the F5 key, clicking the Execute button in the SQL Editor toolbar, or selecting Execute from the Query menu