IMC
cancel
Showing results for 
Search instead for 
Did you mean: 

Syslog and NTA database space used

SOLVED
Go to solution
cad-jk
Occasional Contributor

Syslog and NTA database space used

Hi,

 

Does anyone know how to increase the space used for storing syslog messages as well as flow information in the NTA module?
I have plenty of disk space and there are no limits on database file sizes (I'm using Microsoft SQL Server 2012). However IMC does not want to use more than 274MB for syslog messages. Simmilar thing happens for the NTA module.


7 REPLIES
LindsayHill
Honored Contributor

Re: Syslog and NTA database space used

I'm not sure about NTA, but have you changed any of the settings at System -> System Configuration -> Data Export?

cad-jk
Occasional Contributor

Re: Syslog and NTA database space used

Nope, no settings changed in "System -> System Configuration -> Data Export". 
However, according to manual: "This function helps you export the operation logs, alarm (and other data need to export) automatically. The operation logs, alarms (and other data) meeting the export criteria are backed up and exported to the specified path, and the exported data is deleted from the system."

If data will be exported to an external system it will become unsearchable through IMC.
I'm interested in storing larger amounts of data withing IMC though.

LindsayHill
Honored Contributor
Solution

Re: Syslog and NTA database space used

There's some default settings on when data gets exported to CSV files. It can trigger on time, and/or number of entries. You might want to play around with those settings - it's possible that they're being archived because they're hitting the max age (default 60 days). You could check your exports directory, to see what's being written there.

Of course, it could also be a DB limitation you're hitting - I don't normally have that volume of syslogs to deal with!
cad-jk
Occasional Contributor

Re: Syslog and NTA database space used

Thank you for your replay.
I have disabled all export settings. I'll let you know if I see any changes.

cad-jk
Occasional Contributor

Re: Syslog and NTA database space used

You were right LindsayHill. Disabling the export feature made IMC increase the syslog database size and store more messages.
Thank you for your help.

LindsayHill
Honored Contributor

Re: Syslog and NTA database space used

Good to hear that it's working.

 

For the NTA space, try altering some of the parameters at Service -> Traffic Analysis and Audit -> Settings -> Parameters. I think that should give the same effect.

Re: Syslog and NTA database space used

Hi all,

I have installed iMC and NTA in a distribute enviroment with remote database, and there is no way to configure "data export". What is the behabiour about the data base space management? Does iMC automatically remove old logs? Do I have to make some manual manteinance?

 

Thanks in advance