topic Alerts not stored in SecMon during database compaction period in Network Security

Alerts not stored in SecMon during database compaction period

roxanne.tsui — Sun, 10 Mar 2019 09:15:05 GMT

I used the idsDbCompact utility to compact the SecMon database which took a few hours. After the compaction, I cannot find in the database any alerts generated by the sensors during the compaction period. Is there a way to recover/retrieve those alerts?

Thanks.

Re: Alerts not stored in SecMon during database compaction perio

fbroussard — Fri, 28 Jan 2005 03:25:32 GMT

During the compaction period, the database and other cisco works services are unavailable. Therefore, none of the events that were generated during this period were logged. Use the link below for more information.

http://www.cisco.com/en/US/products/sw/cscowork/ps3991/products_user_guide_chapter09186a0080325c8f.html#wp367698

Faris

Re: Alerts not stored in SecMon during database compaction perio

roxanne.tsui — Fri, 28 Jan 2005 15:43:51 GMT

Thanks Faris. I performed the DB compact as described in the doc. The SecMon is functioning properly after the compact.

I understand that the SecMon cannot poll alerts from the sensors during the compaction. I had expected it to resume alerts subscription to the sensors after compaction, and pull all the alerts from where it left off.

Is there a way to recover these alerts from the sensors? Hope you can help. Thanks.