Welcome Serena Central users! CLICK HERE
The migration of the Serena Central community is currently underway. Be sure to read THIS MESSAGE to get your new login set up to access your account.
Highlighted
JUser Absent Member.
Absent Member.
411 views

Where is DataMonitor content saved in the database?

I have some Active directory data monitors and I want to export them to none arcsight users in the buisness.
Active list data is stored  in ARCSIGHT.ARC_ALD_XXXXX tables, but where is the DataMonitor data stored?

0 Likes
Reply
3 Replies
Outstanding Contributor.. douglas.baker@h1 Outstanding Contributor..
Outstanding Contributor..

Re: Where is DataMonitor content saved in the database?

I believe that is in memory, stop the Data Monitor and lose the data.


0 Likes
Reply
or@we-can.co.il1 Absent Member.
Absent Member.

Re: Where is DataMonitor content saved in the database?

That's true, datamonitor events exist in memory.

If you just need the data, consider using lists or trends.

If you need the datamonitors, and not just their events, you could publish the datamonitors to an external web service.

Not the easiest way to go to, but it turns out quite nice in the end.

View the attached PDF for more info.

Please feel free to contact me at any time.

Or@we-can.co.il

+972-052-3279374

Visit us: http://www.wemeansecurity.com

0 Likes
Reply
scottlsattler
New Member.

Re: Where is DataMonitor content saved in the database?

I had to put in a comment about Arcsight and its value add on moving average data monitors - I think others may be feeling the pain.....

Storing the data In memory I feel is a mistake, as much as we have memory problems and are rebooting/restarting ESM every few days (and just about every other large client having logger to ESM problems driving java to 1000% requiring a restart), we get about 4-7 days worth of moving average......would have been more useful to write it out to disk so you can develop a longer term representation of "normal" traffic patterns

Also is that totally true that it is stored in memory........when restarting ESM, half the dashboard get blanked out, then other half display data and keep on chugging....

0 Likes
Reply
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.