Agents are no longer reporting into the console, but if Symantec Critical System Protections services are stopped and restarted the agents will then show up in the console.
One cause can be that the transaction log in the database is full.
Another cause can be that there is an inconsistency in a database cluster, where one node of the cluster has more/different data than the other. This can cause an agent to "disappear" and then "re-appear" at a later date, as the database cluster service switches between cluster nodes.
The DB has run out of logging space.
This can be checked by looking at the csp-dbinfo.txt file located in the '%ProgramFiles%\Symantec\Critical System Protection\Server\' directory (note this is the default location). This file is automatically updated once per day. Search csp-dbinfo.txt for "Database Status Summary" and note the status. A good status will be GREEN/GREEN. If you get a RED/RED or RED/GREEN, then there is an issue with disk space or no backup has been run. You can also search for "transaction log" and the report will tell you the current and max size of the transaction log.
If the transaction log is full, the current recommendation is the following:
Here are the steps to first back up the database (1-5) and how to shrink the transaction log (6-13).
1. Use ‘sa’ username to login to 'SQL Server Database using SQL Server Management Studio'. 2. Expand Databases, and select SCSPDB database. 3. Right-click the database and select Tasks->Backup 4. Select Backup Type as Full 5. Click on Add and select a backup destination on an external disk. • This will back up the entire database and might take a while to execute. • Please ensure that you have sufficient amount of disk space on external drive. • Press OK. 6. Right-click the instance, and then click Properties, which opens the 'Database Properties' dialog box. 7. In the 'Select a Page' pane, click Options. 8. The current recovery model is displayed in the Recovery model list box. 9. 'Change Recovery' model from Full to Simple. Press OK 10. Right-click the SCSPDB database, and then select ->Tasks->Shrink->Files 11. Change 'File type' from Data to Log. Ensure that • Filename is changed to scsplog • File location ends with SCSPDBlog.ldf 12. Set 'Shrink' action to 'Release Unused Space'. Press OK • The above steps should shrink the transaction log. Verify the transaction log file size on disk. 13. Repeat steps 6 to 9 and set recovery model back from Simple to Full.
Check the tempdb in SQL Server and make sure it isn’t full. If the tempdb is full, use above steps to shrink the database, which can be found under System Databases in SQL Server Management Studio.
In General, the Database is full message means, the customer needs to review the following:
What is the current "Data Retention Plan", specifically how long do you need to keep SCSP events in database?
Review the events that are being logged in database, they will be viewable in the monitors tab of the console, and confirm that they need to be logged in real time.
Any event/s that are for forensic, or compliance use and not for immediate or quick access type use, should be configured to be bulk logged only.
Based on your findings about how long (3 days, 30 days, 90 days, etc.) your "Data Retention Plan" is, please be sure to implement data purging based on this using the settings found in the SCSP manager, to keep only the data you need.
One million events is equal to One GB of Hard drive space, so looking at your 'average agent events' = E, 'over time' = T 'across all agents' =A
E x A x T = Amount of expected stored events
Summary: Review data retention plan and implement 'Event Purging'. Review what is being logged and stored in SCSP database, and reduce if possible, by using 'bulk logging'.
Windows Server Std. 2003 SP2
Imported Document ID: TECH174357
Subscribing will provide email updates when this Article is updated. Login is required to Subscribe