IBM Support

Why I am getting "Disk is getting full!" alert for ​Guardium appliance having enough free space?

Question & Answer


Question

Why I am getting "Disk is getting full!" alert for ​Guardium appliance having enough free space?
Alert:
Subject: (appliance-hostname) Disk is getting full! DB size is estimated to exceed 50.0% of its recommended size in 14 days (reaching 150%), which may lead to space and stability problems.
Top tables, by growth:
GDM_FIELD: +121 MB in last 24 hours; current size: 253 MB;
GDM_OBJECT: +40 MB in last 24 hours; current size: 92 MB;
GDM_SENTENCE: +17 MB in last 24 hours; current size: 39 MB;
DM_EXTRACTION_LOG: +1 MB in last 24 hours; current size: 3 MB;
GDM_ERROR: +0 MB in last 24 hours; current size: 293 MB;
GDM_CONSTRUCT: +0 MB in last 24 hours; current size: 27 MB;
REPORT_RESULT_DATA_ROW: +0 MB in last 24 hours; current size: 5 MB;
AUDIT_PROCESS_LOG: +0 MB in last 24 hours; current size: 2 MB;
GDM_ACCESS: +-1 MB in last 24 hours; current size: 20 MB;
GDM_SESSION: +-1656 MB in last 24 hours; current size: 10 MB;
 

Cause

The alert you are getting on DB space utilization is triggered by the disk and DB health analyzer job.
Alerts are sent when the system predicts that a DB size or files on disk (/var) will reach 50% in the next 14 days.
This job starts the Disk and DB Health Analyzer, which runs at a predefined schedule Whenever you enable the Disk and DB Health Analyzer It reverts to its default start time of 05:07:07.

Answer


Alert description:

Alerts are sent when the system predicts that a DB size or files on disk (/var) will reach 50% in the next 14 days. Alerts detail the predicted size and the largest tables or files. Alerts are also shown in the deployment health dashboard of the central manager.  

The prediction is based on the pace of traffic. You need to check the policy and how much data is being captured that can fill internal DB or file system.

High level steps

1. CLI command to check DB usage and identify largest tables:

support show db-status used %

support show db-top-tables all

2. CLI commands to check filesystem usage and identify large files:

show filesystem usage

support show large_files 10 0    

       (larger than 10MB older than 0 days )

3. Use reports in the GUI to see how much data is in the largest tables per day

Report definitions are available to download in technote:

How much data is in my Guardium top tables per day?

For example: If you notice GDM_CONSTRUCT_TEXT is largest table then "Full SQL per day" report will help you understand how much data is being logged in the table daily.

4.  The below two technotes can help you understand why your internal database is filling up and what actions can be taken to reduce its space.

What can I do if I see my Guardium appliance getting full?

Why is my Guardium internal database filling up?

[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSMPHH","label":"IBM Security Guardium"},"Component":"","Platform":[{"code":"PF004","label":"Appliance"}],"Version":"10.6","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Product Synonym

IBM Guardium

Document Information

Modified date:
15 July 2019

UID

ibm10881099