Syslog and NTA database space used

[cad-jk]

Hi,

Does anyone know how to increase the space used for storing syslog messages as well as flow information in the NTA module?
I have plenty of disk space and there are no limits on database file sizes (I'm using Microsoft SQL Server 2012). However IMC does not want to use more than 274MB for syslog messages. Simmilar thing happens for the NTA module.

[LindsayHill]

I'm not sure about NTA, but have you changed any of the settings at System -> System Configuration -> Data Export?

[cad-jk]

Nope, no settings changed in "System -> System Configuration -> Data Export". 
However, according to manual: "This function helps you export the operation logs, alarm (and other data need to export) automatically. The operation logs, alarms (and other data) meeting the export criteria are backed up and exported to the specified path, and the exported data is deleted from the system."

If data will be exported to an external system it will become unsearchable through IMC.
I'm interested in storing larger amounts of data withing IMC though.

[LindsayHill · Accepted solution]

There's some default settings on when data gets exported to CSV files. It can trigger on time, and/or number of entries. You might want to play around with those settings - it's possible that they're being archived because they're hitting the max age (default 60 days). You could check your exports directory, to see what's being written there.

Of course, it could also be a DB limitation you're hitting - I don't normally have that volume of syslogs to deal with!

[cad-jk]

Thank you for your replay.
I have disabled all export settings. I'll let you know if I see any changes.

[cad-jk]

You were right LindsayHill. Disabling the export feature made IMC increase the syslog database size and store more messages.
Thank you for your help.

[LindsayHill]

Good to hear that it's working.

For the NTA space, try altering some of the parameters at Service -> Traffic Analysis and Audit -> Settings -> Parameters. I think that should give the same effect.

[Ruben_Botella]

Hi all,

I have installed iMC and NTA in a distribute enviroment with remote database, and there is no way to configure "data export". What is the behabiour about the data base space management? Does iMC automatically remove old logs? Do I have to make some manual manteinance?

Thanks in advance