IDS Database files too big

[d-g-c]

I'm receiving this alert from the management centre for IDS sensors :

Name: IDS database files

Size Limit: 8 GB

Current Usage:128.87% (10.31 GB)

Note: Current usage is more than the recommended limit.

How do I prune the size of these files automatically within cisco works?

[Jeffrey Bollinger]

Depends on which version of the IDS MC you're using.

With Security Monitor 2.0, the database pruning is handled automatically by a database pruning daemon. By default, it will prune the database when it hits 2,000,000 events. This default value can be changed by logging into SecMon and going to Admin -> Data Management -> Database -> Pruning Configuration.

Now when the database is pruned, by default it will create an archive of the pruned data in a flat file that is stored in ~\CSCOpx\MDC\secmon\AlertPruneData. This is a directory you will want to watch, because it can grow rapidly. If the archive is no longer needed, it is save to delete these files to reclaim disk space. Another recommended option is to change the pruning directory to a network share so that you don’t have to worry about maintaining that directory. To change the directory, go to Admin -> System Configuration -> Prune Archive Location.

Finally, if you want to change the thresholds at which you are warned, go to Admin -> Data Management -> Files. For each file you can change the value in the Limit column by just clicking on the current value.

For IDS MC 1.2 see this doc:

http://www.cisco.com/univercd/cc/td/doc/product/rtrmgmt/cw2000/mon_sec/secmon12/ug/ch07.htm

[nickbruno]

I am having the same issue. The idsmc.log is almost 8GB itself. When I try to change the size, it says I do not have the proper space available even thoug I have 5GB of free space. Any ideas?

[d-g-c]

Whilst my sybase database seems to be getting pruned automatically by SecMon 2.1 my idsmc.log is still growing - it'a almost 12GB now. Did you get a resolution to your problem? Why isn't CW2K managing the size of this file?

[cburgarella]

Hi had the same problem,

i simply stopped all services by the application, and then removed the idsmdc.log file, that seems not to be the database.

note that you have another file idsmdc.db.

i didn't lost any alert.

[koiflowerhorn]

Hi! We also encountered pruned data that is increasing so fast as well as the idsmdc.db.

1. Is it safe to delete old files at /opt/CSCOpx/MDC/secmon/AlertPruneData? What would be the importance of these files that we should consider for future use?

2. I understand that information in these pruned data no longer exist at idsmdc.db: Events are pruned from the database when the event tables exceed a specified size. The oldest event records are deleted from an event table first. How come the idsmdc.db is still increasing so fast? What does idsdmc.db comprised of?