Monitoring Trend Sizes
i am not sure, if this was discussed earlier. I am quite sure that it was, but i want to start a thread with concrete ideas and measueres to get this solved.
From my point of view, trends are one of the most important resources, as out in the field:
- ESM data retention is not set for reporting purpose, but more from a storage costs perspective
- ESM reporting is a standard requirement and (at least in my customer situations)
- Reporting intervals almost always exceed the event retention (monthly reports, quarterly reports vs. retentions of just a couple of weeks if even)
From that point, trends become very important as THE primary data source for reports and for reasons mentioned above, could hold a huge amount of data. So monitoring trend sizes has to be a mandatory task within ESM projects.
I had a support case open which I turn (hopefully) into a feature request, getting a trend monitoring feature into ESM console.
Until that comes with some future version of ESM, i like to collect good solutions and ideas on how you monitor trends...
A first idea of how we could get this solved is:
1. getting usage information for trends through sqlplus
2. formatting output to make it ready for being imported through a flex connector
3. collecting those flex events and running arcsight standard resources on them
First step would of course be, to get the actual sizes of your trends through running a sqlplus statement like this:
select r.name, (blocks * 32768 / 1024 / 1024) AS storage_usage_in_MB
from user_tables u, arc_resource r, arc_trend t
where substr(u.table_name, 11,17) in
(select t.table_id from arc_trend) and r.id = t.id and r.resource_type=46 and r.inactive = '0' and blocks != '0'
order by blocks;
Is anyone out there, who went this idea one or more steps further?
Looking forward to where this topic leads...