Arellia All Unclassified Applications filter being updated as part of Delta Collection Update schedule
Last Updated September 11, 2013
The "All Unclassified Applications" filter contains all known file resources that do not have a security rating specified. In large scale deployments this filter can contain millions of resources. The filter is considered legacy and provided for backwards compatibility. Moving forward customers should use dynamic filters which scale to a better extent.
The Delta Collection Update schedule incorrectly identifies the All Unclassified Applications filter as being a candidate for delta updates. This can result in large processing time taken by the delta update as it evaluates every file resource for inclusion in the filter. The intended update cycle for the unclassified filter is only on the Always Update schedule which should fire once a day.
Within the SMP the method DeltaCollectionUpdateSchedule.OnSchedule() indirectly calls the SQL stored procedure spDeltaCollectionUpdate which then calls spGetCollectionUpdateList to get the list of candidate filters and collections for delta update.
The issue arises due to bad logic in the SMP stored procedure spGetCollectionUpdateList which will include any collection in vCollection that is listed as a parent item reference in the ItemReference SQL table regardless of Hint type.
By adding the Hint types that Arellia uses in representing filter relationships into the CollectionUpdateHintExclusion table we effectively exclude Arellia filters that should not be updated on the delta update schedule (unless they are referenced by an active policy).
Run the following SQL on the Symantec CMDB database to prevent SMP from incorrectly identifying Arellia filters as candidates for the delta update schedule.
INSERT INTO CollectionUpdateHintExclusion
FROM fnListToTable('datasource,template', ',') f
LEFT JOIN CollectionUpdateHintExclusion c ON f.[str] = c.Hint
WHERE c.Hint IS NULL
Imported Document ID: TECH210487
Subscribing will provide email updates when this Article is updated. Login is required to Subscribe