Managed unit database is filling up

Learn what you can do if your system database is filling up.

Symptoms

  • Cannot log in to GUI.
  • tomcat error on GUI.
  • The Used Disk: in the DB Utilization of the System Monitor page is approaching 100%.
  • Receiving alerts that indicate the database size is getting larger.

Causes

Common causes are:
  • Spikes in the captured data.
  • A policy setting that allows logging of too much data in the internal database.
  • Keeping too many days of data on the internal database.
  • Collecting data from too many S-TAPs.

Resolving the problem

The quickest way to reduce the Used Disk: is to induce a purge of some older data now.

In this scenario Purge data older than 30 days is set, and you have all necessary backups and archives of your system. Now you want to purge off slightly more data.
  1. Note the current Used Disk: in the DB Utilization of the System Monitor page.
  2. Go to Manage > Data Management > Data Archive.
  3. Set Purge Data Older than to 25 days.
  4. Verify that the Purge checkbox is checked.
  5. Verify that the Archive checkbox is cleared.
  6. Verify that the Allow purge without exporting or archiving is checked.
  7. Click Run Once now.
  8. Check progress of the purge in Reports > Guardium Operational Reports > > Aggregation/Archive Log.
    1. Right-click the Archive and select detail log.
    2. Review the status of the purge process in the log.
  9. When the purge is finished, note the current Used Disk: in the DB Utilization of the System Monitor page.
If the difference in the Used Disk: is in the right direction, then consider running the commands again for slightly fewer days. For example, purge older than 20 days.
  • Remember to check the Archive checkbox when you complete these ad hoc purges.
Looking at the causes for this problem you might want to also consider:
  • See the Why is the Guardium internal database is filling up.
  • Amend the policy to capture only the necessary data. For example, not all cases require capturing Full SQL.
  • Switch one or more of the S-TAPs to another collector
  • Amend the Archive and Purge settings to purge more data off each day.
  • Ensure that the Schedule is set to run once per day.
  • After you purge data, you might need to optimize the database. See Resolving internal database full problems.
  • If that does not help or you cannot access the GUI, contact Guardium Support.