Pruning events

[cburgarella]

Hi all,

I'm tring to prune the events with database rules.

I made two rules:

1) PruneByAge 5

2)PruneMarkedForDeletion "syslog"

triggered daily.

neither of these rules works, the report says " 0 record pruned".

The database (idsmc.db) is growing too much, slowing the system.

How can i reduce the database size, on a daily basis?

Thanks for your answer.

[ravarada]

Hi CRISTIANO,

"PruneByAge 5" will remove the data from the database for the data older than 5 days.

By default it includes all the tables in the database. So there is no chance of have the data which is older than 5 days.

You can limit the alarm by numbers. (Ex. 1Million or 2Million), so that your database will not grow more than the limit size. For that you can use "PrunebyDefault.pl scripts"

PruneMarkedForDeletion "syslog" will delete the data from syslog table which is already marked for delete.

You can use the above one only if you delete the alarms using event viewer. And why you use only "syslog" table if you leave this blank it will include "alert,syslog and auditlog" data.

Regards

Ramesh V