In the situation when DB is full event queue might be corrupted. Events are
queued locally at the Sensor and at the EC waiting for the OK from the DB.
Only afterwards they are removed. If the queue is corrupted the sensor or
the EC won't start.
I've attached tool that, I hope, will help you to analyze and/or
re-initialize the queue and to solve your problem.
Thanks to Jean Paul from ISS.
(See attached file: ADFQueueMaint.zip)
---
Best regards, Sergey V. Soldatov.
"Ernie Chen \(XBOX\)"
<[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]>
Sent by: cc:
[EMAIL PROTECTED] Subject: [ISSForum] Help: Siteprotector
Database/Event Collector
Fatal Error
13.04.2004 00:32
Event Collector Status is reporting:
Offline - Fatal Error! The event collector cannot connect to the
database or there is a database error. The Event Collector must be
shutdown. Its connection to the database and the sensors in order to
prevent events from getting lost. This could be due to a
misconfiguration of the Event Collector, network communication problems,
or a problem with the database itself (e.g. database full)
[ID=0xc734002f]
This occurred after I tried running manual maintenance on the database
because it grew to the point where automatic maintenance could not run.
To save time, I followed the following instructions to truncate all
data, then shrink the database files. I am now getting the event
collector error above. I have tried downloading the latest XPU and
applying, restarting the server, etc.
CLEARING/TRUNCATING THE DATABASE
Truncating the database is much faster than purging the database because
it simply deletes all of the event data from the database.
WARNING: Only do this if you want to remove *ALL* of your data.
The query to truncate the event data is:
exec iss_TruncateTables
The query to truncate the transaction logs is:
backup log realsecuredb with truncate_only
SHRINKING THE DATABASE
Your database files are very large preallocated files and the size of
the files does not necessarily reflect the size of the database. You
may be using a lot less data than the size of the file. If you would
like to shrink your filesize down to the size of the database, this is
how you do it.
The query to shrink your event data is:
Dbcc shrinkfile ('SiteProtector enterprise database primary
data file', TRUNCATEONLY) (Note: I had to substitute 'enterprise' with
'site' for this to work)
To shrink your transaction logs, use the query:
Dbcc shrinkfile ('SiteProtector enterprise database log
file', TRUNCATEONLY) (Note: I had to substitute 'enterprise' with
'site' for this to work)
_______________________________________________
ISSForum mailing list
[EMAIL PROTECTED]
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo/issforum
To contact the ISSForum Moderator, send email to [EMAIL PROTECTED]
The ISSForum mailing list is hosted and managed by Internet Security
Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.
Scanned by evaluation version of Dr.Web antivirus Daemon
http://drweb.ru/unix/
_______________________________________________
ISSForum mailing list
[EMAIL PROTECTED]
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo/issforum
To contact the ISSForum Moderator, send email to [EMAIL PROTECTED]
The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303
Barfield Road, Atlanta, Georgia, USA 30328.
