LMS 3.2 Data purge

[adamgibs7]

Hello Dear's

We have installed CS 3.2 and RME on 1 server on C: Drive. Now the problem is C: Drive is full with MB of space behind, when i went through the Cisco Works folder  i found location CSCOpx/files/rme/syslogpurgeddata files are occupying space in GB so i planning to delete these files,

My concern is if i m deleting these files is it will crashed my CS and RME.???????????  AND  these files are just the sylogs which have been received by devices?????   Correct me if i m wrong

Thanks

[AFROJ AHMAD]

Hi  ,

Yes there should not be any problem if you clear that : ( CSCOpx/files/rme/syslogpurgeddata)

Please make sure you are not deleting the syslogdb files under (CSCOpx/database/rmeng)

Rest everything should be fine..

Thanks--

Afroj

If this post answers your question, please click the "Correct Answer" button"

[adamgibs7]

Hello Afroj,

I dont want it to be deleted manually. They shld be deleted automatically according to the syslog purge job which is default to 7 days in RME..Please correct me if i m wrong???

Why is it so the syslog purge job not working in RME.

Thanks

[Martin Ermel]

you HAVE TO delete these files manually - for details about the meaning of "syslog purge" jobs and "syslog backup" (which is the cause of the issue) see this thread:
    https://supportforums.cisco.com/message/3209757#3209757

[adamgibs7]

Hello,

Thanks for ur reply,

• I Have database syslog files (syslogfirst.db,syslogsecond.db) which are occupying the space in C drive, i want to  clear them how can i do that.But i have 1 query when syslog purge is enabled default for 7 days  when RME is installed then why this syslog database files are grown so huge ????

• How i can clear those files, As it is not best practice to delete them manually i have read in threads that we have to use the tool DB space reclaimer to clean up those file can u help me to run this command.

• Another solution i found is reinitiating the RME database, how can i do that what  is the command,

RME is 4.2 and CS is 3.2.

Thanks

[Martin Ermel]

you are correct, syslogfirst.db,syslogsecond.db and syslogthird.db are files you should never delete manually and you need to contact TAC to get the procedure and the necessary java file to reclaim the diskspace.
But like Afroj mentioned it is save to delete the files in NMSROOT/files/rme/syslogpurgeddata

syslog consumes a lot of disk space when a lot of messages are coming in.. Firewall logging send to the syslog server could be a reason as well as roaming messages from wireless APs - or it is just the "normal" behaviour - it depends on the network.
Reinitialization of RME will removes all data from RME - like device configuration, inventory all your RME jobs and all historical data. I definitely would prefer contacting TAC.
But if you have set syslog purge to 7 days from the beginning I assume the amount of your syslog messages is huge and if that is truth I doubt that you could reduce the size of syslogfirst.db, etc.
What is the size of these files?/files/rme/syslogpurgeddata?

[edit]

as far as I know DBSpaceReclaimer.class is included in LMS 3.2 - but currently I cannot verfy it. It will remove the three dataspaces (syslogfirst.db, etc.) and - if I remember well it - will also whipe out the current content of the RME syslog db

the header of this thread mention LMS 3.2 but in your last post you wrote CS 3.2 RME 4.2 - both are LMS 3.1 - verify your version under Common Services > Software Center > Software Update; an overview of all LMS applications and versions can be found here: Cisco Works - Appliccations and Versions -

[adamgibs7]

Hello Mermel,

Thanks for ur precious reply,

It is a Mistake from my end,Cisco Security Manager 3.2  whcih  includes RME 4.2 and Common Services 3.2.

• I dont have TAC support contract better i will initialize  the database Can u help me with the command for initializing.

• Where i have to put filters for syslog so that only from level 4 it will keep logs ( warning,emergencies, alerts,criticals) in the database.

• When syslog purge was enabled  bydefault for 7 days  then why database syslogs files are increased so huge.

• Suppose if we reinitialize the database all devices will be deleted from RME ???? or only config archieve,inventory archieve,change configs log

Thanks