lsmaint -rebuild -- any convenient way to run across all devicetypes?
The "Report Performance Primer" for version 4.1 says "for historical data you MUST prioritize and re-index event data to achieve performance improvements", using the lsmaint -rebuild command.
What's a convenient way to run lsmaint across a lot of data and devices? As a command line utility, do I have to sit with an RDP window open all day while the tool runs? Can I put it in a batch job and schedule it to run off hours?
I have to imagine running this against our firewall and Windows logs is going to take a long time, even if cut up into single day or week long chunks. I've run a few lightly-trafficed devicetypes by hand, but there doesn't seem to be a way to predict how long the process will take.
There is no way to estimate how long this process will take, so if you think it will take a long time, just create a simple batch script with your lsmaint command to run when you are not at the machine. You don't need to sit there are watch it
I am not sure if this is the correct syntax as it has been a while since I have used but I think this will do the trick:
lsmaint -rebuild all -time <start> <end> -devices *
Thanks Lee, I created a batch job to run the reindexing and scheduled it with Task Scheduler. Added some logging so I can see how long the various devicetypes take to process.
While this isn't something that is done regularly, it sure would be nice to have some access to the lsmaint options (-rebuild, -fix) from inside the GUI.