IBM Support

Guardium purge process on collector purges data for the same day on a daily basis

Troubleshooting


Problem

I have noticed under aggregation/archive log that Purge is happening for the same days with some records purged every day. The days for which purge is happening are already beyond the purge period.

Environment

v9

Diagnosing The Problem

Check Guardium Monitor -> Aggreagtion/Archive log report

Resolving The Problem

GUI purge process will only purge off records for sessions that are closed.
These sessions will have an INACTIVE_FLAG = 0 and the sessions will be gradually purged as and when they are closed OR killed by Session inference process that runs on appliances. If the collector purge period is less than the session active days and there are sessions that are running for multiple days, you might see the records being purged for older days too since the sessions are not actually closed. This is expected behavior

[{"Product":{"code":"SSMPHH","label":"IBM Security Guardium"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"General Information","Platform":[{"code":"PF016","label":"Linux"}],"Version":"9.0;9.1;9.5","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
16 June 2018

UID

swg21999127