MsSql: Trace File Warning messages

[sandeepu]

Dears,

We are receiving following errors in SQL Server Multiple Instance Audit DB connectors. Does anybody come across the same errors, please suggest.

WARN ][default.com.arcsight.agent.af.d][isSafeToProcess] The trace file [\\kwtsqlprod1\sqltrace\newtrace_81838.trc]i is not ready for processing.

[WARN ][default.com.arcsight.agent.loadable.agent._MultiSQLServerTraceAuditingAgent][processQuery()] Failed to process query [[select TOP 1 * FROM ::fn_trace_gettable('c:\Program Files\Microsoft SQL Server\MSSQL\Data\trace_new_15.trc', 1)]] on database URL[jdbc:odbc:IBS], bitmechanic URL

Please suggest further.

Thanks,

Sandeep N

[pratikp]

Hi Sandeep,

In SQL server, SQL database keeps appending the data in .trc file till it reaches its maximum size limit. (Default is 200MB) . After reaching maximum size, it creates new .trc file and start appending data in it till it reaches maximum size and so on.

ArcSight SmartConnector can not read files which are getting written by database i.e which has not reached its maximum size limit.

"newtrace_81838.trc" mentioned by you above is still written by database and has not reached its limit. Hence not ready for processing by ArcSight.

So you have to wait till its ready for processing and you can ignore this.

I hope this helps.

Regards,

Pratik

[sandeepu]

Hello Pratik,

Thanks for the response. Could you let me know, how can we decrease this file size to get it processed (currently it is 1 MB)

Thanks,

Sandeep N

[pratikp]

Hi Sandeep,

I am not sure whethere that file size can be changed.

It will be better if you check with SQL admin.

Regards,

Pratik

[Rajesh6]

Hi Pratik,

I am also facing the exact similar issue and in my case .trc file size is more than 10MB. 

Kindly suggest what is the minimum size limit to get it processed by ArcSight?

Hope I will get a response. Thanks in advance.

Regards,

Prasanna Reddy