delete log at CSA

Unanswered Question
Jan 6th, 2008
User Badges:

Hi all,

I use CSA version 5.1, I install CSA at DNS, MAIL and WEB. Now, when I connect to webpage of CSA to manage, I see the inform "he event database now contains approximately 900004 events. This is in danger of exceeding the configured limit. In order to preserve correct operation, events of priority Alert and below will not be logged. Since the last report of this type, 1 events have not been logged. Please purge the event database as soon as possible." and I can't receive log from all server at DMZ. Now, I want to delete log at CSA MC and I can receive log from all server at DMZ. How can I do that?

Thank you very much.

Best regards,

Duy Khang


  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (3 ratings)
Loading.
tsteger1 Sun, 01/06/2008 - 23:13
User Badges:
  • Red, 2250 points or more

Duy Khang,

You will need to delete some events starting with old and/or unimportant ones first and then purge the database.


Mine stays at around 200000.


You'll also want to configure your event logging to log only those events you want see and/or retain.


That should keep it from filling up.


What DB are you using?


Tom

mylove142 Sun, 01/06/2008 - 23:25
User Badges:

Thank you for your answer. I install CSA MC at Windows 2003 and CSA agent is installed at DNS, Mail, WEB (operating is Solaris). How can I delete some events?

tsteger1 Mon, 01/07/2008 - 09:50
User Badges:
  • Red, 2250 points or more

Use "Events>Event Sets" and create an event set for all events older than 30 days and purge them, then shrink the database.


Are you using MS SQL for the DB?


Tom

mylove142 Mon, 01/07/2008 - 20:24
User Badges:

I also configure auto-pruning and configure to delete log in 30 days but when I show in "Event - Events Log", I aslo see logs. I don't know the cause ? maybe I configure wrong. You can look the following attachment file.

Thank you very much.



tsteger1 Mon, 01/07/2008 - 20:40
User Badges:
  • Red, 2250 points or more

Duy Khang


Your autopruning hasn't been triggered yet.


Check the DB size and see if it's less than 3072 MB.


You'll need to manually delete events and possibly change the DB size if you want to autoprune.


Tom

mylove142 Mon, 01/07/2008 - 22:40
User Badges:

How can I check DB size? How can I delete events manually? Please show me because I am a newbie.

tsteger1 Tue, 01/08/2008 - 10:56
User Badges:
  • Red, 2250 points or more

Check DB size at the Maintenance> Database Maintenance screen.


Delete events manually by using Events>Event Sets.


Create an event set that includes all events older than 30 days by cloning "All events in the last 7 days", changing the timestamp to all events older than 30 days and purge the events.


Tom

Actions

This Discussion