Support Center > Search Results > SecureKnowledge Details
Past Events in SmartEvent are deleted when current database size reaches 200 GB or after 365 days
Symptoms
  • Past Events in SmartEvent are deleted when current database size reaches 200 GB or after 365 days.
Cause

Possible causes:

SmartEvent Client - 'Policy' tab - General Settings - Database Status:

  • the maximum size of the database parameter is set to 204800 MB.
  • the maximum days that events may be stored parameter is set to 365 days.

Solution

This problem was fixed. The fix is included in:

Check Point recommends to always upgrade to the most recent version (upgrade Security Gateway / upgrade VSX / upgrade Security Management Server / upgrade Multi-Domain Security Management Server).

 

For lower versions, follow these steps:

In case SmartEvent is installed on the Security Management Server machine, close all SmartConsole Clients.

On the CLI of SmartEvent machine:

  1. Check that the FWM process is up:

    [Expert@HostName]# cpwd_admin list

    'FWM' has to be on the list, and in the 'STAT' column the state should be 'E' (executing)

  2. Create a new file 'change_configuration.txt' (location does not matter) and add one or both of these lines, as needed:

    • To change the maximum size of the database, add the following line to the file:

      modify abacus_db_mgmt db_mgmt_properties max_size <New_Max_Size_in_MegaBytes>

      Note: The maximal possible value for <New_Max_Size_in_MegaBytes> is 232-1.

    • To change the maximum days to store events, add the following line to the file:

      modify abacus_db_mgmt db_mgmt_properties days_to_keep <New_Number_of_Days>

      Note: The maximal possible value for <New_Number_of_Days> is 232-1.


  3. Merge the new configuration into the database:

    [Expert@HostName]# dbedit -local -f /path_to/change_configuration.txt

  4. When asked to update, enter "y":

    abacus_db_mgmt::db_mgmt_properties was not updated. update now ?[y/n] y

  5. The following confirmation should appear:

    abacus_db_mgmt::db_mgmt_properties Updated Successfully

  6. Connect with SmartEvent Client to SmartEvent machine - go to 'Actions' menu - click on 'Install Event Policy'

  7. After several minutes, check that the corresponding parameters were changed:

    SmartEvent Client - go to 'Policy' tab - General Settings - Database Status - check the corresponding parameters and their values.

 

Related solution: sk98095 (Value of 'days_to_keep' configured per sk69706 is not applied).

This solution is about products that are no longer supported and it will not be updated

Give us Feedback
Please rate this document
[1=Worst,5=Best]
Comment