topic Re: Syslog and NTA database space used in IMC

Syslog and NTA database space used

cad-jk — Thu, 11 Jul 2013 11:33:11 GMT

Hi,

Does anyone know how to increase the space used for storing syslog messages as well as flow information in the NTA module?
I have plenty of disk space and there are no limits on database file sizes (I'm using Microsoft SQL Server 2012). However IMC does not want to use more than 274MB for syslog messages. Simmilar thing happens for the NTA module.

Re: Syslog and NTA database space used

LindsayHill — Thu, 11 Jul 2013 22:26:02 GMT

I'm not sure about NTA, but have you changed any of the settings at System -> System Configuration -> Data Export?

Re: Syslog and NTA database space used

cad-jk — Fri, 12 Jul 2013 06:43:48 GMT

Nope, no settings changed in "System -> System Configuration -> Data Export".
However, according to manual: "This function helps you export the operation logs, alarm (and other data need to export) automatically. The operation logs, alarms (and other data) meeting the export criteria are backed up and exported to the specified path, and the exported data is deleted from the system."

If data will be exported to an external system it will become unsearchable through IMC.
I'm interested in storing larger amounts of data withing IMC though.

Re: Syslog and NTA database space used

LindsayHill — Fri, 12 Jul 2013 06:55:00 GMT

There's some default settings on when data gets exported to CSV files. It can trigger on time, and/or number of entries. You might want to play around with those settings - it's possible that they're being archived because they're hitting the max age (default 60 days). You could check your exports directory, to see what's being written there.

Of course, it could also be a DB limitation you're hitting - I don't normally have that volume of syslogs to deal with!

Re: Syslog and NTA database space used

cad-jk — Fri, 12 Jul 2013 07:43:36 GMT

Thank you for your replay.
I have disabled all export settings. I'll let you know if I see any changes.

Re: Syslog and NTA database space used

cad-jk — Sun, 14 Jul 2013 17:14:28 GMT

You were right LindsayHill. Disabling the export feature made IMC increase the syslog database size and store more messages.
Thank you for your help.

Re: Syslog and NTA database space used

LindsayHill — Sun, 14 Jul 2013 20:38:00 GMT

Good to hear that it's working.

For the NTA space, try altering some of the parameters at Service -> Traffic Analysis and Audit -> Settings -> Parameters. I think that should give the same effect.

Re: Syslog and NTA database space used

Ruben_Botella — Mon, 18 Apr 2016 08:28:52 GMT

Hi all,

I have installed iMC and NTA in a distribute enviroment with remote database, and there is no way to configure "data export". What is the behabiour about the data base space management? Does iMC automatically remove old logs? Do I have to make some manual manteinance?

Thanks in advance