sandeepu Absent Member.
Absent Member.
769 views

MsSql: Trace File Warning messages

Dears,

We are receiving following errors in SQL Server Multiple Instance Audit DB connectors. Does anybody come across the same errors, please suggest.

WARN ][default.com.arcsight.agent.af.d][isSafeToProcess] The trace file [\\kwtsqlprod1\sqltrace\newtrace_81838.trc]i is not ready for processing.

[WARN ][default.com.arcsight.agent.loadable.agent._MultiSQLServerTraceAuditingAgent][processQuery()] Failed to process query [[select TOP 1 * FROM ::fn_trace_gettable('c:\Program Files\Microsoft SQL Server\MSSQL\Data\trace_new_15.trc', 1)]] on database URL[jdbc:odbc:IBS], bitmechanic URL

Please suggest further.

Thanks,

Sandeep N

Labels (3)
0 Likes
4 Replies
Highlighted
pratikp Absent Member.
Absent Member.

Re: MsSql: Trace File Warning messages

Hi Sandeep,

In SQL server, SQL database keeps appending the data in .trc file till it reaches its maximum size limit. (Default is 200MB) . After reaching maximum size, it creates new .trc file and start appending data in it till it reaches maximum size and so on.

ArcSight SmartConnector can not read files which are getting written by database i.e which has not reached its maximum size limit.

"newtrace_81838.trc" mentioned by you above is still written by database and has not reached its limit. Hence not ready for processing by ArcSight.

So you have to wait till its ready for processing and you can ignore this.

I hope this helps.

Regards,

Pratik

sandeepu Absent Member.
Absent Member.

Re: MsSql: Trace File Warning messages

Hello Pratik,

Thanks for the response. Could you let me know, how can we decrease this file size to get it processed (currently it is 1 MB)

Thanks,

Sandeep N

0 Likes
pratikp Absent Member.
Absent Member.

Re: MsSql: Trace File Warning messages

Hi Sandeep,

I am not sure whethere that file size can be changed.

It will be better if you check with SQL admin.

Regards,

Pratik

0 Likes
Frequent Visitor.. Rajesh6
Frequent Visitor..

Re: MsSql: Trace File Warning messages

Hi Pratik,

I am also facing the exact similar issue and in my case .trc file size is more than 10MB. 

Kindly suggest what is the minimum size limit to get it processed by ArcSight?

Hope I will get a response. Thanks in advance.

Regards,

Prasanna Reddy

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.