[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[ISSForum] tempdev and templog full



Cesar,
You need to turn on the database maintenance option.

This will enable regular purges of your data.
You can configure for how many days you want to keep which type of data.

Also you need to turn on Emergency purge, which is also configurable. You can define at what threshold the emergency purge will start to delete data.

You have to do that by right click on the SP database in the SP console, the choose SiteProtector database, then Database Maintenance.

In addition, you need to carefully inspect your policies and examine which events you have turned on.
i.e. If you have the Attack and Audit policy enabled, you will get many thousands of events, most of them might not be relevant for your environment.

Regards,


Markus
-
Markus Brütsch, CISSP, CISM
TZ: US Pacific
mailto:mbruetsch%40iss%2enet


...when you have eliminated the impossible, whatever remains, however improbable, must be the truth. Sherlock Holmes 

-----Original Message-----
From: issforum-bounces@xxxxxxxxxxxxxxxx On Behalf Of issforum-request@xxxxxxxxxxxxxxxx
Sent: Wednesday, April 06, 2005 09:01
To: issforum@xxxxxxxxxxxxxxxx
Subject: ISSForum Digest, Vol 15, Issue 4


Send ISSForum mailing list submissions to
	issforum@xxxxxxx

To subscribe or unsubscribe via the World Wide Web, visit
	https://atla-mm1.iss.net/mailman/listinfo/issforum
or, via email, send a message with subject or body 'help' to
	issforum-request@xxxxxxx

You can reach the person managing the list at
	issforum-owner@xxxxxxx

When replying, please edit your Subject line so it is more specific than "Re: Contents of ISSForum digest..."


Today's Topics:

   1. tempdev and templog full (Cesar Farro Flores)


----------------------------------------------------------------------

Message: 1
Date: Tue, 5 Apr 2005 15:56:44 -0500
From: "Cesar Farro Flores" <cesar.farro@xxxxxxxxxxxxxxxxx>
Subject: [ISSForum] tempdev and templog full
To: ISSForum@xxxxxxx
Message-ID:
	<OFC54AB6A8.F9408BF0-ON05256FDA.0071665B-05256FDA.00730F0D@xxxxxxxxx>
Content-Type: text/plain; charset=iso-8859-1

Hi guys :

My scenario :
      - Two IPS G200
      - HPML 350 Application Server
      - HPML 350 Event Collector and Data Base  (Hard Disk is 76 GB  - >
C : 40 GB   and  D :30 GB )
         * La Base de datos esta el unidad C.
      - HPML 110  Securitu Fusion
      - Workstation - SPConsole

Problem :
Today  I could´nt   enter to my Application Server because in my Event
Collector DataBase  i t was  disk full  , basically the following files were :
      C:\Program Files\Microsoft SQL Server\MSSQL\Data :
            - templog.ldf -> 34GB
            - tempdb.mdf -> 6GB
Then we removed  the data and modified  the initial values  by  "SQL Server
Enterprise Manager " :   LOCAL \ Databases\tempdb -> Properties :
      - Data Files  -> File Name : tempdev - > Maximum file size : Restrict file growth (MB) :  8000 - File Growth by Percent 10
      - Data Files  -> File Name : templog  - > Maximum file size : Restrict file growth (MB) :  8000 - File Growth by Percent 10

Then we could enter to my application server , but it is a temporal solution because rigth now we have only one IPS working the next week we will have working  two IPS  inline  with  high traffic,  So the file growth will  execeed my hard disk , are there documentation to prevent it ?

I will appreciate your help,

Cesar F.







------------------------------

_______________________________________________
ISSForum mailing list
ISSForum@xxxxxxx

TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum

TO CONTACT THE ISSForum MODERATOR, send email to mod-issforum@xxxxxxx

The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.

End of ISSForum Digest, Vol 15, Issue 4
***************************************
_______________________________________________
ISSForum mailing list
ISSForum@xxxxxxx

TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum

To contact the ISSForum Moderator, send email to mod-issforum@xxxxxxx

The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.