Cisco Secure ACS

[Erik Molenaar]

Running Cisco Secure ACS version 5.6, we encounter the following problem. ACS sends me the following message:

Cisco Secure ACS - Alarm Notification
Severity: Warning

Alarm Name	System Alarm [Database Purging]
Cause/Trigger	The number of incoming log messages is reaching the threshold value : 4.15GBs
Alarm Details	The number of incoming log messages is reaching threshold value: 4.15GBs.Make sure that you configured ACS to send only the important category of messages to Log collector.
Generated On	Thu May 21 04:00:00 CEST 2015

Strange thing however as you can see this is at 4.00 am when watching the switchport there's hardly any traffic - 4.15 GBps, on a 1Gbps interface. I know Cisco sells good hardware but that's absurd. Probably one of those new compression techniques ;-)

Does anyone have a clue?

[Marcus Hunold]

Hi, as I understand the notification it wants to tell you that all log messages together takes 4.15 GBytes of the local harddisk. Data purging is a daily process always started at 4 am. I think it purges only old log messages in the way you have configured in "Maximum Stored Data Period". If you have configured 1 year and you collect a lot of messages each day then it takes a lot of space on your HDD.