Is there any way to purge/truncate a database where the dataase is full or does not have free space ?If you mean your transaction log is full, check out the DUMP TRAN options - you need to do a non-logged truncate if you don't have enough space in your log to log the truncation. I think that option is NO_LOG, and you should immediately backup your database after executing it.
Then, you need to manage your log so it doesn't happen again.
Finally, buy more disk space. It costs more to manage space with limited resources than to buy the additional resources.|||The transanction logs are really small. the database is actually part of a intruder detection system and the database can grow pretty rapidly even with alerts.|||A good IDS comes with archiving capabilities and filtering that needs to be fine-tuned to satisfy your business needs as well as to ensure you're not running out of space by trying to collect every login/logout. Check if archiving is turned on and exclude events that your business is not interested in. A serious security investigation will always bring tools like nCase so whatever you filtered out can always be answered through other means.|||Aggregation would seem like a no-brainer.
How much space we talking here? We have a database that logs every event on every web site we host - and we're doing > 45 tps. Our processes aggregate and delete data based on business rules: for example, maintain 90 days (moving window) of detail, but aggregate every night.
I'm clueless how this compares to IDS, but we are capturing every bit of information available and that comes out to over 4,800 bits per transaction. (No worries - nothing personally identifiable.)
This has been running for more 1.5 years on the same box and we have only needed the detail once - when we screwed up and lost some aggregates. Fortunately, our customers are rather perceptive and caught the problem w/in a couple of days. Everthing was recovered by re-running the aggregates.
Again, buy more disk space. Seriously, how much is your time worth? It is not the solution, but more resources will give you time to solve the problem.
Subscribe to:
Post Comments (Atom)
No comments:
Post a Comment