Cesar,
You need to turn on the database maintenance option.
This will enable regular purges of your data.
You can configure for how many days you want to keep which type of data.
Also you need to turn on Emergency purge, which is also configurable. You can
define at what threshold the emergency purge will start to delete data.
You have to do that by right click on the SP database in the SP console, the
choose SiteProtector database, then Database Maintenance.
In addition, you need to carefully inspect your policies and examine which
events you have turned on.
i.e. If you have the Attack and Audit policy enabled, you will get many
thousands of events, most of them might not be relevant for your environment.
Regards,
Markus
-
Markus Brütsch, CISSP, CISM
TZ: US Pacific
mailto:mbruetsch%40iss%2enet
...when you have eliminated the impossible, whatever remains, however
improbable, must be the truth. Sherlock Holmes
-----Original Message-----
From: issforum-bounces@atla-mm1.iss.net On Behalf Of
issforum-request@atla-mm1.iss.net
Sent: Wednesday, April 06, 2005 09:01
To: issforum@atla-mm1.iss.net
Subject: ISSForum Digest, Vol 15, Issue 4
Send ISSForum mailing list submissions to
issforum@iss.net
To subscribe or unsubscribe via the World Wide Web, visit
https://atla-mm1.iss.net/mailman/listinfo/issforum
or, via email, send a message with subject or body 'help' to
issforum-request@iss.net
You can reach the person managing the list at
issforum-owner@iss.net
When replying, please edit your Subject line so it is more specific than "Re:
Contents of ISSForum digest..."
Today's Topics:
1. tempdev and templog full (Cesar Farro Flores)
----------------------------------------------------------------------
Message: 1
Date: Tue, 5 Apr 2005 15:56:44 -0500
From: "Cesar Farro Flores" <cesar.farro@t-empresas.com.pe>
Subject: [ISSForum] tempdev and templog full
To: ISSForum@iss.net
Message-ID:
<OFC54AB6A8.F9408BF0-ON05256FDA.0071665B-05256FDA.00730F0D@tp.com.pe>
Content-Type: text/plain; charset=iso-8859-1
Hi guys :
My scenario :
- Two IPS G200
- HPML 350 Application Server
- HPML 350 Event Collector and Data Base (Hard Disk is 76 GB - >
C : 40 GB and D :30 GB )
* La Base de datos esta el unidad C.
- HPML 110 Securitu Fusion
- Workstation - SPConsole
Problem :
Today I could´nt enter to my Application Server because in my Event
Collector DataBase i t was disk full , basically the following files were :
C:\Program Files\Microsoft SQL Server\MSSQL\Data :
- templog.ldf -> 34GB
- tempdb.mdf -> 6GB
Then we removed the data and modified the initial values by "SQL Server
Enterprise Manager " : LOCAL \ Databases\tempdb -> Properties :
- Data Files -> File Name : tempdev - > Maximum file size : Restrict
file growth (MB) : 8000 - File Growth by Percent 10
- Data Files -> File Name : templog - > Maximum file size : Restrict
file growth (MB) : 8000 - File Growth by Percent 10
Then we could enter to my application server , but it is a temporal solution
because rigth now we have only one IPS working the next week we will have
working two IPS inline with high traffic, So the file growth will execeed
my hard disk , are there documentation to prevent it ?
I will appreciate your help,
Cesar F.
------------------------------
_______________________________________________
ISSForum mailing list
ISSForum@iss.net
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo/issforum
TO CONTACT THE ISSForum MODERATOR, send email to mod-issforum@iss.net
The ISSForum mailing list is hosted and managed by Internet Security Systems,
6303 Barfield Road, Atlanta, Georgia, USA 30328.
End of ISSForum Digest, Vol 15, Issue 4
***************************************
_______________________________________________
ISSForum mailing list
ISSForum@iss.net
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo/issforum
To contact the ISSForum Moderator, send email to mod-issforum@iss.net
The ISSForum mailing list is hosted and managed by Internet Security Systems,
6303 Barfield Road, Atlanta, Georgia, USA 30328.
