Database Cleanup

I'm using Orion 8.1 and Netflow 2.1. My Database is now 116 GB and I'm trying to clean it up. I found a post showing the query

truncate table traps

truncate table trapvarbinds

to clean up the Trapvarbinds table but I cannot find what info is located in the Trapvarbinds table. Can someone tell me what is in it? My TrapVarbinds table is currently 82 GB. We are trying to keep our data for 120 Days. The netflow data should be keeped compressed for 7 days but the database just grows and grows.

Another table that I would like to clean up is AlertLog and SysLog do you have a query to clean them up., Currently the AlertLog is 8 gb and syslog is 5.6

Thank you

Find more posts tagged with

syslog_server

truncate

Accepted answers

All comments

jkennedy

The trap varbind table stores most of the payload contained in the received traps. You'll usually have a few rows for each trap received because the traps are parsed out with each OID in a separate row. You should look at how many traps are returned in a search inside the trap viewer and estimate how many you store per day. I know if we tried to store all of the traps for 120 days our DB would be HUGE.

You can also create rules/filters to discard the traps that you do not want to keep.

Ian.darce

Thank you for the reply..

I changed my SysLog table to only collect for 60 days and the Daily Statistics to keep for only 90 days but my database hasn't shrunk. How can I remove the data that is in there from 120 days? I ran the Database maintenance but that didn't seem to do anything. My total DB size is now 130 Gb and growing.

Orion Version 8.1.0 NetFlow 2.1

TrapVarbinds 91.8 GB NetFlowSummary2 11.4 GB AlertLog 7.5 GB SysLog 5.6 GB

Retain Detail Stats	7 Days
Retain Hourly Stats	30 Days
Retain Daily Stats	90 Days
Retain Events	30 Days

Thank you

mark_wiggans

Can you truncate the TrapVarbinds table? or can you turn off the traps? - after you truncate you can Compact or wait until the nightly maintenance to see a dramatic reduction in DB size-

Ian.darce

I found one of your posts that you gave the commands:

truncate table traps

truncate table trapvarbinds

I dont want to lose all my data in the table. How do I truncate the data older than 90 days? We need to keep collecting current data so I cant turn the traps off. As soon as I can remove the data I will run the maintenance.