Marinos Roussos

How to: Clean all the data from db table for Automatic Monitoring (BETA)10.6 & 11

Discussion created by Marinos Roussos on Feb 21, 2018
Latest reply on Mar 8, 2018 by Marinos Roussos

The purpose of this article is to alert other customers of this hidden BETA feature that engineering think that is disabled by default when it's not.

 

There is a bug open with RSA since 2016 but based on the evidence it doesn't seem that they want to fix it.

 

This feature completely made rabbitmq, IM and SMS to collapse in 10.6 and Support were investigating for more than a month to figure out what was the problem.

Eventually RSA CE asked us to drop the contents of 3 tables which accounted for 18GB of uncompressed data.

 

esmbaselinedata

esmaggregatedata

esmbaselineanalytics

 

Engineering initially thought that is was us (the customer) enabling it, before I provided plenty of screenshots showing the opposite. Then they made this statement:

 

"ESM baseline analytics related collections seem to be taking good amount of space in memory. So the automatic monitoring (its in beta) is disabled in many other environments."

 

 

To my surprise, I see that a BETA feature with its tables not maintained, could eventually affect rabbitmq,SMS and IM (even though ESM is not a separate service) as it is still enabled by default in v11. Not impressed.

 

If you face similar problems with services falling apart without explanation, check if you have this "very well tested feature" enabled by default. 

 

You can quickly check the size of esm db, and it should be a few hundred MBs, even though there is no mechanism in place to purge old data so I can't think of how you would have a few MBs if this was enabled.

 

To check:

On SA server:

mongo

show dbs

Then check the size of ESM

 

 

To perform the cleanup: 

On SA server:

service puppet stop

service rsa-sms stop

mongo esm

 

On the mongo prompt:

db.esmbaselinedata.drop();

db.esmaggregatedata.drop();

db.esmbaselineanalytics.drop();

exit

service rsa-sms start

service puppet start

Attachments

Outcomes