Hello,
we've been having issues for some time with the management of audit log storage on the server in the database, which tends to cause it to grow unnecessarily large.
There's a discrepancy between the retention parameters we specify in our audit package and the parameters the server uses.
For example, max_count=10, keep_days=30.
The WAPT agent correctly uses both parameters with their values, but the WAPT server only uses keep_days and not max_count. This means, for example, that for an audit using the LLDP protocol we've implemented, which retrieves the switch and the workstation's connection port, we've specified max_count as 10 and keep_days as 365 to only retain the last 10 audit logs over 365 days. However, the server doesn't take max_count into account, only keep_days. This results in one audit of the packet every 2 hours for 365 days across nearly 9,000 machines... you can imagine the volume; it represented 8 GB in the database audit table.
Another problematic audit is BitLocker. There are 1,117,000 BitLocker key audits for almost 9,000 machines. In fact, the encryption value is different with each audit, generating a new entry. We're looking at approximately 600 BitLocker audit entries per machine in the database.
Currently, the WAPT audit table represents 40 GB out of the database's total 49 GB.
I think there are things that need improvement to prevent this database from exploding with audit management.
Thank you for your feedback,
Rémy Esberard
Problem of audits overloading the database
Forum Rules
Community Forum Rules
* English support on www.reddit.com/r/wapt
* French community support is available on this forum
* Please prefix the topic title with [RESOLVED] if it is resolved.
* Please do not edit a topic that is tagged [RESOLVED]. Open a new topic referencing the old one.
* Specify the installed WAPT version, full version, and build number (2.2.1.11957 / 2.2.2.12337 / etc.) as well as the Enterprise/Discovery edition.
* Versions 1.8.2 and earlier are no longer supported. The only questions accepted regarding version 1.8.2 are related to upgrading to a supported version (2.1, 2.2, etc.).
* Specify the server OS (Linux/Windows) and version (Debian Buster/Bullseye - CentOS 7 - Windows Server 2012/2016/2019).
* Specify the OS of the administration/package creation machine and the machine with the problematic agent, if applicable (Windows 7/10/11/Debian 11/etc.).
* Avoid asking multiple questions when opening a topic, otherwise it may be ignored. If there are multiple topics, open separate topics, preferably one after the other and not all at the same time (i.e., do not spam the forum).
* Include code snippets, screenshots, and other images directly in the post. Links to Pastebin, Bitly, and other third-party sites will be systematically removed.
* As with any community forum, support is provided voluntarily by members. If you require commercial support, you can contact Tranquil IT's sales department at 02.40.97.57.55
Community Forum Rules
* English support on www.reddit.com/r/wapt
* French community support is available on this forum
* Please prefix the topic title with [RESOLVED] if it is resolved.
* Please do not edit a topic that is tagged [RESOLVED]. Open a new topic referencing the old one.
* Specify the installed WAPT version, full version, and build number (2.2.1.11957 / 2.2.2.12337 / etc.) as well as the Enterprise/Discovery edition.
* Versions 1.8.2 and earlier are no longer supported. The only questions accepted regarding version 1.8.2 are related to upgrading to a supported version (2.1, 2.2, etc.).
* Specify the server OS (Linux/Windows) and version (Debian Buster/Bullseye - CentOS 7 - Windows Server 2012/2016/2019).
* Specify the OS of the administration/package creation machine and the machine with the problematic agent, if applicable (Windows 7/10/11/Debian 11/etc.).
* Avoid asking multiple questions when opening a topic, otherwise it may be ignored. If there are multiple topics, open separate topics, preferably one after the other and not all at the same time (i.e., do not spam the forum).
* Include code snippets, screenshots, and other images directly in the post. Links to Pastebin, Bitly, and other third-party sites will be systematically removed.
* As with any community forum, support is provided voluntarily by members. If you require commercial support, you can contact Tranquil IT's sales department at 02.40.97.57.55
-
sfonteneau
- WAPT Expert
- Messages: 2318
- Registered: July 10, 2014 - 11:52 PM
- Contact :
Hi Rémy,
actually the max_count only concerns the database of the local WAPT agent. The server only relies on keep_days; that's how it performs cleanup.
If the server were listening to the agent's max_count, the WAPT agent could modify its history with the max_count, which wasn't the intended behavior.
In the case of BitLocker, it's indeed an error because the package does use if_changed , but... since it also uses rsa_encrypted_data_str, it gets updated every time because rsa_encrypted_data_str is encrypted differently each time. It's definitely an error in the package; we need to look into improving it.
For example, we could implement a max_count on the server side, but not one decided by the client.
actually the max_count only concerns the database of the local WAPT agent. The server only relies on keep_days; that's how it performs cleanup.
If the server were listening to the agent's max_count, the WAPT agent could modify its history with the max_count, which wasn't the intended behavior.
In the case of BitLocker, it's indeed an error because the package does use if_changed , but... since it also uses rsa_encrypted_data_str, it gets updated every time because rsa_encrypted_data_str is encrypted differently each time. It's definitely an error in the package; we need to look into improving it.
For example, we could implement a max_count on the server side, but not one decided by the client.
