You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 7 Next »

Purpose

Purging may not have been set up at installation time.  If the OMK database has grown large it's a good idea to purge it in 90 day increments until the desired retention period is realized.

Determine the Purge Older Than Value

In order to purge from the database in 90 day increments the date of the oldest record is required.

[root@opmantek ~]# mongo -u opUserRW -p op42flow42 nmis --eval 'db.rawlogs.findOne()'
MongoDB shell version v3.4.9
connecting to: mongodb://127.0.0.1:27017/nmis
MongoDB server version: 3.4.9
{
        "_id" : ObjectId("5543df5db5d690352f1eb2cb"),
        "entry" : "2015-05-01T16:17:19\t10.73.225.166\tUDP: [10.73.225.166]:14445->[10.72.0.31]\tSNMPv2-MIB::sysUpTime.0=23:5:15:52.26\tSNMPv2-MIB::snmpTrapOID.0=SNMPv2-SMI::enterprises.8072.4.0.3\tSNMPv2-MIB::snmpTrapEnterprise.0=SNMPv2-SMI::enterprises.8072.4",
        "time" : NumberLong(1430511439),
        "eventid" : ObjectId("5543df5db5d690352f1eb2ca"),
        "type" : "nmis_traplog"
}

Notice the 'time' property above; 1430511439.  The date command may be used to reveal when this was.

[root@opmantek ~]# date --date @1430511439
Fri May  1 20:17:19 UTC 2015

The purge command can be passed a value in minutes with the option 'events_purge_older_than'. 

### Current unix epoch time
[root@opmantek ~]# date +%s
1513316674

### Let X be The difference of current time and oldest record time converted to minutes
>>> (1513316674-1430511439)/60
1380087.25

### There are 129600 minutes in 90 days.  Subtract 129600 minutes from X.
>>> 1380087 - 129600
1250487

### Based on this the events_purge_older_than should be 1250487

Run the opEvents Purge Command

First run the command in simulate mode to ensure the math is correct

[root@DC4-opmantek02 ~]# /usr/local/omk/bin/opevents-cli.exe act=purge events_purge_older_than=52560 debug=1 simulate=true
[Fri Dec 15 05:54:31 2017] [debug] cli[31377] Purging unwanted database indices
[Fri Dec 15 05:54:31 2017] [debug] cli[31377] Db purge of rawlogs: 0 entries (of 7161464) in rawLogs are older than 1y270d50m
Db purge of rawlogs: 0 entries (of 7161464) in rawLogs are older than 1y270d50m
[Fri Dec 15 05:54:31 2017] [debug] cli[31377] Simulated purging rawlogs: would remove 0 (of 7161464) entries from rawLogs
Simulated purging rawlogs: would remove 0 (of 7161464) entries from rawLogs
[Fri Dec 15 05:54:31 2017] [debug] cli[31377] Purging disabled for archivelogs
Purging disabled for archivelogs
[Fri Dec 15 05:54:33 2017] [debug] cli[31377] Db purge of events: 4692044 entries (of 5060913) in events are older than 36d12h
Db purge of events: 4692044 entries (of 5060913) in events are older than 36d12h
[Fri Dec 15 05:54:33 2017] [debug] cli[31377] Simulated purging events: would remove 4692044 (of 5060913) entries from events
Simulated purging events: would remove 4692044 (of 5060913) entries from events
[Fri Dec 15 05:54:37 2017] [debug] cli[31377] Db purge of events: 12831334 entries (of 13803156) in actionlog are older than 36d12h
Db purge of events: 12831334 entries (of 13803156) in actionlog are older than 36d12h
[Fri Dec 15 05:54:37 2017] [debug] cli[31377] Simulated purging events: would remove 12831334 (of 13803156) entries from actionlog
Simulated purging events: would remove 12831334 (of 13803156) entries from actionlog
[Fri Dec 15 05:54:37 2017] [debug] cli[31377] Purging disabled for reports
Purging disabled for reports

 

 

 

 

 

 

  • No labels