Highlighted
Absent Member.
Absent Member.
840 views

Delete Partition from Active Partitions

Hello,

I am running ESM 4.5.2 and have a question about deleting old partitons not needed or wanted in ESM. If you look at my screenshot we have a bunch of partitions in Active Partitions for july 2010, aug 2011, and a few for feb 2012. I cant figure out how to remove these from ArcSight. We also have a bunch of partitions from april and may 2010 in Inactive Partitions. I would like to get rid of those also. I have gone through the partition archiver and set the retention policies to what we need but these old partitions are still around. Any help would be appreciated. Thanks

Labels (1)
0 Likes
Reply
6 Replies
Absent Member.
Absent Member.

Re: Delete Partition from Active Partitions

I am looking for information on this as well. We have a lot of old inactive partitions that I would like to delete but I can't figure out how. Can someone point me to a doc or guide for deleting old inactive partitions?

0 Likes
Reply
Highlighted
Absent Member.
Absent Member.

Re: Delete Partition from Active Partitions

I am wondering this too.

0 Likes
Reply
Highlighted
Absent Member.
Absent Member.

Re: Delete Partition from Active Partitions

Are you running Partition Archiver? If so, it should be archiving, if not then Partition Manager is only allowed to purge 1 partition at a time. So, if you are not running PA, then from the console in the partitions section, right click and choose Run Scheduled Task Now-> Partition Maintenance, this will give PM an additional run to purge old partitions. You will know if you have that issue as well if you see something like "only allowed to purge 1 partition" in the partitionmanager.log files in ARCSIGHT_HOME/logs/default.

Or you can open a support ticket and the Support DBAs can provide scripts to clean this up. The reason we don't make the scripts available to everyone is that they can wipe out your entire database if you are not careful.

regards,

Kerry

0 Likes
Reply
Highlighted
Established Member..
Established Member..

Re: Delete Partition from Active Partitions

Hi Karman,

You can refer to the KB "KM1270954" for changing the settings for purging more than 1 partition at a time. I'm pasting it as well.

I do remember that there was an article on how to purge partitions, but maybe my mind is playing tricks on me .

Anyhow, good luck! give us a shout if anything.

Use the following instructions to configure the Partition Manager purge more than onepartition per day:

1. Set the OS environment variable ARCSIGHT_JVM_OPTIONS=-DMAX_PARTITIONS_TO_BE_PURGED=X, where X will be the number ofpartitions to be purged per day.
This example allows 3 partitions to be purged per day:

On Windows platforms, the command is as follows:

set ARCSIGHT_JVM_OPTIONS=-DMAX_PARTITIONS_TO_BE_PURGED=3

To confirm the setting: From the same cmd, please type set and you should see the above line added to list

On Unix platforms, the command is as follows:

export ARCSIGHT_JVM_OPTIONS=-DMAX_PARTITIONS_TO_BE_PURGED=3

To confirm the setting: from the same cmd, please type export and you should the above line added to the list

2. At a time when there is no partition management services are running, perform only ONE of the following options:

a. Stop the Manager service.

b. Run the Partition Manager in stand alone mode from the Manager server by executing the following command from <ARCSIGHT_HOME>/bin:

arcsight database pm -i standalone -cn manage

c. Start the Manager service.

OR

a. Stop and Start the Manager service.

b. Login to the Console as an admin user.

c. Navigate to the Partitions and choose Run Scheduled Task Now >Partition Maintenance

The Scheduled job runs immediately, and should purge the partitions missed.

3. Re-run GetPartitionInfo.sql and review the output to confirm that the requiredpartitions were purged. For more details on running this script, refer to Answer 572.

0 Likes
Reply
Highlighted
Honored Contributor.
Honored Contributor.

Re: Delete Partition from Active Partitions

Hi experts,

We have a issue with ESM archive.We have upgraded the ESM to 5.2 a couple of weeks back. After some days the ARC_Event_DATA and ARC_Event_Index table spaces in ESM got filled.We set the retention period to 14 days as it was earlier.But still the space didnt clear.We also did the Partion Mantainance activity & can see only 10% of fee space.Even the retention period was set to 7 days.

so is there any other way out of it.Please advice if any of you has anything or if anyone has encountered this earlier.

Thanks

0 Likes
Reply
Highlighted
Absent Member.
Absent Member.

Re: Delete Partition from Active Partitions

Hi Biswabhushan

Have you got the answer or solutions for your post, im also looking for it ?

Regards

HariKrishna

0 Likes
Reply
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.