IBM Support

Guardium Appliance may fill up with lots of small expired Lucene files - How do I clean them up ?

Question & Answer


Question

It has been noticed in some v9.5 in appliances, there can be some files like below that fill /var although their size is small - How can they be cleared out ?

Cause


Sample 1:


    127/var/guard-solr/INDEX_ACCESS_1/data/index/_4x_Lucene41_0.doc
    145/var/guard-solr/INDEX_ACCESS_1/data/index/_4x_Lucene41_0.tim

Sample 2:

    103/var/dump/LUCENE/index/20151111.EXPIRED/_np_Lucene41_0.doc
    105/var/dump/LUCENE/index/20151111.EXPIRED/_b2_Lucene41_0.doc
    107/var/dump/LUCENE/index/20151111.EXPIRED/_np_Lucene42_0.dvd
    108/var/dump/LUCENE/index/20151111.EXPIRED/_b2_Lucene42_0.dvd
    109/var/dump/LUCENE/index/20151111.EXPIRED/_4h_Lucene41_0.doc
    109/var/dump/LUCENE/index/20151111.EXPIRED/_7o_Lucene42_0.dvd
    109/var/dump/LUCENE/index/20151111.EXPIRED/_eg_Lucene41_0.doc
    109/var/dump/LUCENE/index/20151111.EXPIRED/_eg_Lucene42_0.dvd
    110/var/dump/LUCENE/index/20151111.EXPIRED/_4h_Lucene42_0.dvd
    110/var/dump/LUCENE/index/20151111.EXPIRED/_7o_Lucene41_0.doc
    114/var/dump/LUCENE/index/20151111.EXPIRED/_l0_Lucene42_0.dvd
    118/var/dump/LUCENE/index/20151111.EXPIRED/_l0_Lucene41_0.doc
    118/var/dump/LUCENE/index/20151111.EXPIRED/_sd_Lucene41_0.tim
    131/var/dump/LUCENE/index/20151111.EXPIRED/_hu_Lucene41_0.tim
    143/var/dump/LUCENE/index/20151111.EXPIRED/_7o_Lucene41_0.tim
    143/var/dump/LUCENE/index/20151111.EXPIRED/_b2_Lucene41_0.tim
    143/var/dump/LUCENE/index/20151111.EXPIRED/_np_Lucene41_0.tim
    144/var/dump/LUCENE/index/20151111.EXPIRED/_eg_Lucene41_0.tim
    145/var/dump/LUCENE/index/20151111.EXPIRED/_4h_Lucene41_0.tim



So what are these EXPIRED lucene files ? How do I remove them ?


Prior to p530, the search engine was called Lucene. When an appliance is upgraded to p530 or higher, the installation converts the old Quick Search mode (lucene) to the new Enterprise Search mode (Solr). It marks the old index files as .EXPIRED and they are not used at all. These files are not removed during normal purge but it does remove them for the new Solr type.

The old expired files stay in the appliance until the next GUI startup.

Answer

To clean up old expired lucene files, restart the gui from a cli prompt :-


    restart gui

If it does not delete the files, contact IBM Technical Support via a PMR who will then
- log in as user root
- delete everything under folder /var/dump/LUCENE/index

* NOTE do not remove the folder /var/dump/LUCENE/index itself or change existing permission of the folder.

Related Information

[{"Product":{"code":"SSMPHH","label":"IBM Security Guardium"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"Guardium Database Activity Monitor","Platform":[{"code":"PF016","label":"Linux"}],"Version":"9.5","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
16 June 2018

UID

swg21984762