I was asked the following question: "I upgraded my device to Content 2.0 but the reports only show data since I upgraded. How do I fix this?"
You need to run lsmaint to reindex the data. For example, “lsmaint –rebuild all –devicetype winevent_nic –time 1M end"
For the old data...you rebuild...but the new data you are collecting willl end up in the new table. Just wanted to be clear because a rebuild is not what "activates" the Content 2.0...it is having the Content 2.0 XML that "activates" it.
So, I have a question...if you don't do the rebuild does all of your data before you do the 2.0 ESU update remain in the old tables? or is there a rebuild that just happens on a schedule...I ask because I purposely did not do a rebuild on my Oracle data, but now when I try to run EE it shows all of the old data in the new variables.
This is good to know. I just updated the lastest content to 2.0 in our dev environment. But now after reading this, I don't think it's wise to do our production. We keep 18 months of data and if it's taken you this long to try to rebuilt just one device, it sounds like I'll never get any of ours rebuilt.
I'd be curious to know what the benefits are of upgrading to content 2.0 over the 1.0? Is this something I should or need to be doing or is it fine to just continue using the 1.0?
Retrieving data ...