Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security ISSForum
[Top] [All Lists]

RE: [ISSForum] tempdev and templog full

Subject: RE: [ISSForum] tempdev and templog full
Date: Thu, 7 Apr 2005 19:18:00 +0400
1. You can use purge DB manually by means of iss_PurgeSD and iss_PurgeObs 
stored procedures ixecuting them from Query Analyzer. Information about how to 
use them is available in ISS knowledge base article ## 1146

2. You also should configure automatic db maintenance from SP Console: right 
click on SiteProtector Database component -> SiteProtector Database -> Database 
Maintenance. Use online help for references.

3. Before DB maintenance became to be working well I used self-written script 
that also works on SP 2.0 sp5+. I don't use it any more. Here it is:
/*
 * DB Purge, svsoldatov 24.08.2004
 */

USE RealSecureDB

declare @today datetime   --today date
declare @deltaSD int      --how long SensorSata have to be stored
declare @deltaObs int     --how long Observances have to be stored
declare @edgeSD datetime  --oldest date in SensorData
declare @edgeObs datetime --oldest date in Obserances
select @deltaSD = -120
select @deltaObs = -150

select @today = getdate()
select @edgeSD = DATEADD ( day , @deltaSD, @today)
select @edgeObs = DATEADD ( day , @deltaObs, @today)
--select @today as 'Today', @edgeSD as 'Edge of SensorData', @edgeObs as 'Edge 
of Observances'
select min(AlertDateTime) as 'Min', max(AlertDateTime)as 'Max' from SensorData

exec iss_PurgeSD @edgeSD
exec iss_PurgeObs @edgeObs
select min(AlertDateTime) as 'Min', max(AlertDateTime)as 'Max' from SensorData


Good luck!
-----Original Message-----
From: issforum-bounces@iss.net [mailto:issforum-bounces@iss.net] On Behalf
Of Cesar Farro Flores
Sent: Tuesday, April 05, 2005 11:57 PM
To: ISSForum@iss.net
Subject: [ISSForum] tempdev and templog full

Hi guys :

My scenario :
      - Two IPS G200
      - HPML 350 Application Server
      - HPML 350 Event Collector and Data Base  (Hard Disk is 76 GB  - >
C : 40 GB   and  D :30 GB )
         * La Base de datos esta el unidad C.
      - HPML 110  Securitu Fusion
      - Workstation - SPConsole

Problem :
Today  I could´nt   enter to my Application Server because in my Event
Collector DataBase  i t was  disk full  , basically the following files
were :
      C:\Program Files\Microsoft SQL Server\MSSQL\Data :
            - templog.ldf -> 34GB
            - tempdb.mdf -> 6GB
Then we removed  the data and modified  the initial values  by  "SQL
Server
Enterprise Manager " :   LOCAL \ Databases\tempdb -> Properties :
      - Data Files  -> File Name : tempdev - > Maximum file size :
Restrict
file growth (MB) :  8000 - File Growth by Percent 10
      - Data Files  -> File Name : templog  - > Maximum file size :
Restrict file growth (MB) :  8000 - File Growth by Percent 10

Then we could enter to my application server , but it is a temporal
solution because rigth now we have only one IPS working the next week we
will have working  two IPS  inline  with  high traffic,  So the file
growth
will  execeed my hard disk , are there documentation to prevent it ?

I will appreciate your help,

Cesar F.





_______________________________________________
ISSForum mailing list
ISSForum@iss.net

TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-
mm1.iss.net/mailman/listinfo/issforum

To contact the ISSForum Moderator, send email to mod-issforum@iss.net

The ISSForum mailing list is hosted and managed by Internet Security
Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.

_______________________________________________
ISSForum mailing list
ISSForum@iss.net

TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to 
https://atla-mm1.iss.net/mailman/listinfo/issforum

To contact the ISSForum Moderator, send email to mod-issforum@iss.net

The ISSForum mailing list is hosted and managed by Internet Security Systems, 
6303 Barfield Road, Atlanta, Georgia, USA 30328.

<Prev in Thread] Current Thread [Next in Thread>