Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Pruning events

Hi all,

I'm tring to prune the events with database rules.

I made two rules:

1) PruneByAge 5

2)PruneMarkedForDeletion "syslog"

triggered daily.

neither of these rules works, the report says " 0 record pruned".

The database (idsmc.db) is growing too much, slowing the system.

How can i reduce the database size, on a daily basis?

Thanks for your answer.

1 REPLY
New Member

Re: Pruning events

Hi CRISTIANO,

"PruneByAge 5" will remove the data from the database for the data older than 5 days.

By default it includes all the tables in the database. So there is no chance of have the data which is older than 5 days.

You can limit the alarm by numbers. (Ex. 1Million or 2Million), so that your database will not grow more than the limit size. For that you can use "PrunebyDefault.pl scripts"

PruneMarkedForDeletion "syslog" will delete the data from syslog table which is already marked for delete.

You can use the above one only if you delete the alarms using event viewer. And why you use only "syslog" table if you leave this blank it will include "alert,syslog and auditlog" data.

Regards

Ramesh V

81
Views
0
Helpful
1
Replies
CreatePlease login to create content