TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to [EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems! ----------------------------------------------------------------------------
Hi all, My sincere gratitude and thanks to Richard Anderson, Brian Fitch and Grant Slender for providing me with alternative solutions and tips for housekeeping the enterprise database. I'll try out the DBMS utility recommended by Grant: http://www.iss.net/support/product_utilities/realsecure_tech_center/utilities/index.php and also Brian's tip to stop the EventCollector from grabbing data while I purge the overwhelmed database. Off to work again! Cheerios, Vic -- On Mon, 1 Apr 2002 16:41:17 Fitch, Brian (ISS Atlanta) wrote: >the SensorEventQueue.ADF file is static. Default is 15Mb but you can adjust >this in the network sensor properties from the console GUI. > > >-----Original Message----- >From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] >Sent: Monday, April 01, 2002 4:28 PM >To: Fitch, Brian (ISS Atlanta) >Cc: '[EMAIL PROTECTED]'; Apers, Kim (ISS Brussels) >Subject: RE: Enterprise Database Housekeeping in MS SQL 2000 > > > >THis is Gustavo Ossandon on the same topic. > >What is the rate of growing for tis SensorEventQueue.ADF .... on a busy >100 half segment ... ? >What is the grow limit for this SensorEventQueue.ADF ( file I presume ) ??? > > >all space left on disk ???? > > > >Thanks in advance > > >Gustavo > > > > > > >"Fitch, Brian (ISS Atlanta)" <[EMAIL PROTECTED]> >Sent by: [EMAIL PROTECTED] >01-04-2002 03:44 PM > > To: "'[EMAIL PROTECTED]'" <[EMAIL PROTECTED]>, "Apers, Kim >(ISS Brussels)" <[EMAIL PROTECTED]> > cc: [EMAIL PROTECTED] > Subject: RE: Enterprise Database Housekeeping in MS SQL 2000 > > > > >TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to >[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any >problems! >---------------------------------------------------------------------------- > >You can stop the event collector and perform database maintenance. If the >event collector is down, the sensors queue up data in their >SensorEventQueue.ADF which is then flushed once the event collector comes >back online and polls the sensors for their data. > >Brian Fitch >Systems Engineer >Internet Security Systems, Inc. > > >-----Original Message----- >From: vico gav [mailto:[EMAIL PROTECTED]] >Sent: Monday, April 01, 2002 6:53 AM >To: '[EMAIL PROTECTED]'; Apers, Kim (ISS Brussels) >Cc: [EMAIL PROTECTED] >Subject: RE: Enterprise Database Housekeeping in MS SQL 2000 > > > >TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to >[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any >problems! >---------------------------------------------------------------------------- > >Hi all, > >My appreciation and gratitude to everyone (Tim Walker, Don Liew, Marco >Proulx, Kim Apers, Hudson Cress) for their advice and opinions. It certainly >has given me an eye-opener on maintaining my database. I have fine-tuned the >policy in the IDS to record only traffic that is to be monitored, but >company policy has it that I have to monitor certain traffic that is awfully >heavy almost 24 hours a day. That is why I have to do the backup/purge thing >to make sure the reports are generated almost instantaneously. (I can't ask >for better RAID stuff on the database ....ya' know finance dept....yada >yada) > >Anyway, i've tried to use the option of "Clear Date Range" at the console >(View > Options > Enterprise Database > Maintain) and set the timeout at the >default value (300 seconds/5 mins). HOwever, adter a while, there was an >error stating that the database is locked and that I should try deleting the >records when there are less events being logged. I tried increasing the >timeout value to 3000 seconds. But after some time, the same error occurs >again. > >This is where my dilemna begins. I cannot stop monitoring the network just >to purge my database and I am dangerously reaching the last few gigs of >space left on my hard disk. Is this database locked issue a common problem >people always face? Or are ther specific procedures and steps to take for >maintaining the IDS database? > >Thanks again! > >Cheerios, > >Vic > >-- > >On Sat, 30 Mar 2002 13:12:19 >Apers, Kim (ISS Brussels) wrote: >>There is a iss_truncateevents stored procedure that will wipe out the >>database. >>From the console there is a cleanup data from/to a certain date. >> >>-----Original Message----- >>From: vico gav [mailto:[EMAIL PROTECTED]] >>Sent: vrijdag 29 maart 2002 10:32 >>To: [EMAIL PROTECTED] >>Cc: [EMAIL PROTECTED] >>Subject: Enterprise Database Housekeeping in MS SQL 2000 >> >> >> >>TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to >>[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any >>problems! >>--------------------------------------------------------------------------- >- >> >>Good day all, >> >>I am currently running RS6.5's Enterprise Database on MS SQL Server 2000; >>and plan to schedule backups/purging of the ISSED database using the SQL >>Server Enterprise Manager. >> >>There are options to backup, restore and shrink the database in the SQL >>Server Enterprise manager; however, I could not find any options to purge >>the database. Does that mean I have to write my own T-SQL scripts to purge >>data? >> >>Besides using the ISSED utilities provided by ISS, are there any other >>standard ways of backups and purges? To be more precise, is there an option >>to the a "log-switch (CheckPoint LogViewer terminology)" type of method >>where the ISSED data is backed-up/archived in a different location and the >>active ISSED database is cleared/purged completely? >> >>Previewing Reports (eg. Top 20 Events) is painfully slow on the RealSecure >>Console (approx.10 minutes) eventhough the console is running separately >>from the Enterprise DB+Asset DB+EventCollector on a P4-256MB_Ram box with >>only the RealSecure Console services installed. That is why I came to a >>conclusion that besides being an IDS admin, I have to be a database admin >as >>well. >> >> >>Cheerios, >> >>Vic >> >> >>See Dave Matthews Band live or win a signed guitar >>http://r.lycos.com/r/bmgfly_mail_dmb/http://win.ipromotions.com/lycos_02020 >1 >>/splash.asp >> >> > > >See Dave Matthews Band live or win a signed guitar >http://r.lycos.com/r/bmgfly_mail_dmb/http://win.ipromotions.com/lycos_020201 >/splash.asp > See Dave Matthews Band live or win a signed guitar http://r.lycos.com/r/bmgfly_mail_dmb/http://win.ipromotions.com/lycos_020201/splash.asp
