metadb on logdecoder and concentrator

[AngeOlivierAmbe]

hello all,

I have only 4 firewalls in a configuration and after some time metadb on logdecoder and concentrator don't have more space, how can resolve this issue ? rollover ?

Thanks.

[AkramHamed]

Hello,

Metadb on decoder is not a large one by design, given that there is no meta aggregation done on decoder (only very few).

On concentrator, its configured to roll over by default at 95% of the partition /var/netwitness/concentrator/metadb

So whenever this value is reached, it will roll over.

If you want to increase retention, you will need to increase the size of this partition (this can be easily done on VM, and on physical appliances you will need to get a DAC which is extra storage).

Let me know if that helped or if you have further questions.

Akram Hamed

[AngeOlivierAmbe]

Hello Hamed,

is possible the roll over at 95 % not happen ?

in my case the disk reach 100% and the on decoder and concntrator and the both services stop working.

Ange. O

[Anonymous]

I've seen something like this happen on some Virtual Machines, where there was one big volume but the database settings were all the same.  Check the decoder Explore/database/config for the meta.dir, packet.dir, and session.dir and compare that with the amount of available disk space.