Unable to Delete a High Number of Alerts or Events via the Management Console

Version 3

    This document has been superseded with SQL scripts to preview / delete events

    Introduction

    Having an excessive amount of Alert & Event Data can impact on Management Center Console operations.  If you have captured an excessive amount of Event and Alert Data within the ManagementCenter(for example you be capturing a High Volume Events such as 9000/9001) you find that when you attempt to remove them via the Management Console, the operation fails.

     

    Detail

    Running this operation can cause the configured SQL connection timeout to lapse and terminate the running script.  Even after reconfiguration, the console may well still fail to complete this operation due to the amount of data being removed.

     

    It must also be noted that removing a large amount of Events/Alerts via the Management console can cause excessive Transaction Log Growth.

     

    It is possible to remove the Alert/Event Data directly from the Database via TSQL using the scripts in the following zip file.

     

    The deletion scripts are executed in batches to prevent IO locks and also to limit the Transaction Log Growth during execution, this Batch amount can be re-configured based on what the Specific System can handle.

     

    • See Attachment : EventsAlertsDeprecatedScripts.zip (below)

     

    The scripts can be used via SQL Management Studio to:

     

    • Select the amount of current Event Data captured in the Database.  This is ordered and grouped into Year/Month/Event Type/Count columns
    • Delete a configured amount of Events from the database that is older than a configured amount of days
    • Delete all Event data for a specific Deployment Group
    • Delete all Event data for a specific Event ID
    • Delete All Alert data from the database that is older than a configured amount of days

     

    The latest version also deletes events from the Deprecated events SQL table, introduced in Management Server 8.7.

     

    CAUTION: If you have more than 500,000 events (in total) then we recommend that you contact AppSense Support for assistance with removing these events. This is not a definitive figure but once you go beyond this number, deleting via TRUNCATE is probably a better option and will greatly reduce the load on the SQL Server.

     

    It is not recommended to capture High Volume Events such as 9000/9001 in a production environment. These type of events are mainly aimed at smaller test environments to gain an understanding of what impact your configuration is having.