hello all,
I have only 4 firewalls in a configuration and after some time metadb on logdecoder and concentrator don't have more space, how can resolve this issue ? rollover ?
Thanks.
hello all,
I have only 4 firewalls in a configuration and after some time metadb on logdecoder and concentrator don't have more space, how can resolve this issue ? rollover ?
Thanks.
Hello Hamed,
is possible the roll over at 95 % not happen ?
in my case the disk reach 100% and the on decoder and concntrator and the both services stop working.
Ange. O
I've seen something like this happen on some Virtual Machines, where there was one big volume but the database settings were all the same. Check the decoder Explore/database/config for the meta.dir, packet.dir, and session.dir and compare that with the amount of available disk space.
Hello,
Metadb on decoder is not a large one by design, given that there is no meta aggregation done on decoder (only very few).
On concentrator, its configured to roll over by default at 95% of the partition /var/netwitness/concentrator/metadb
So whenever this value is reached, it will roll over.
If you want to increase retention, you will need to increase the size of this partition (this can be easily done on VM, and on physical appliances you will need to get a DAC which is extra storage).
Let me know if that helped or if you have further questions.
Akram Hamed