topic Re: what will happen if ACS database full !!! in Network Access Control

what will happen if ACS database full !!!

Rps-Cheers — Mon, 11 Mar 2019 08:51:41 GMT

Hi everyone,

I have a issue that is about acs,these days,our acs occur a alarm is "Physical size of ACS db is more than 50% of its Actual Size".

I think it's bug CSCum51180,and i want to enter "acs-config" in CLI,to confirm acs database.But,when i issue " acsview show-dbsize", there is not any output,just like this:

----------------

acs23/acsadmin(config-acs)#acsview show-dbsize

acs23/acsadmin(config-acs)#

---------------

So,i want to know is there any abnormal? And if the acs database full, what will be happened?whether we cannot access to ACS?

Re: what will happen if ACS database full !!!

Jason Kunst — Sat, 10 Nov 2018 20:24:08 GMT

There should be protection mechanism so that it doesn’t fill up

i will confirm

Please work with tac to troubleshoot

Re: what will happen if ACS database full !!!

Rps-Cheers — Sun, 11 Nov 2018 15:18:48 GMT

But,there is not cisco contract about the device...

Re: what will happen if ACS database full !!!

Jason Kunst — Sun, 11 Nov 2018 16:49:52 GMT

We are checking internally to see. Recommendation would be to remove to Identity services engine with an update contract

Re: what will happen if ACS database full !!!

kthiruve — Mon, 12 Nov 2018 16:42:15 GMT

I did not see the output of the acsview show db-size command.

The bug was fixed in 5.5 and 5.6.

The alarm should come up only with the size of disk is more than 1GB but it seemed to appear even before that.

Alarm was changed to warning.

In any case it would be good to compress and truncate transactional logs. Do it in a maintenance window just to make sure it does not impact users.

https://www.cisco.com/c/en/us/td/docs/net_mgmt/cisco_secure_access_control_system/5-4/command/reference/cli/cli_app_a.html#98188

Finally ACS 5.4 is EOL and End of Support

https://www.cisco.com/c/en/us/products/collateral/security/secure-access-control-system/eos-eol-notice-c51-732647.html

ISE is the next generation ACS. Please look at ACS to ISE migration for details how to migrate over to ISE

https://community.cisco.com/t5/security-documents/acs-to-ise-migration/ta-p/3644038

Thanks

Krishnan

Re: what will happen if ACS database full !!!

Rps-Cheers — Wed, 14 Nov 2018 15:12:04 GMT

Hi Jason，
Thanks a lot for your response.the error just as before i told.i plan to confirm the database usage by the command “acsview show-dbsize” for acs-config.But there is no any output，so i don‘t know the database space how to useage.in addition,I also worry about i cannot login the acs if the database full，or some other abnormal things.

Re: what will happen if ACS database full !!!

Jason Kunst — Fri, 16 Nov 2018 17:38:39 GMT

per sme o@kthiruve you need to truncate the logs and compress the database. You can do that first if you think the database is full independent of the output display of disk size.