topic Re: Indexed Log setting in MDS/MLM in Firewall and Security Management

Indexed Log setting in MDS/MLM

RAJ30_AZ — Tue, 08 Jun 2021 18:14:58 GMT

Hi,

Have a plan to change the indexed log setting of MLM R80.40 from 14 days to 30 days.. I have never done this changes, though it looks quite simple, i just need confirmation on couple of items.

Does it require install database to apply these setting on CLM ?

Does it require any restart like smartconsole or anyother services ?

Did we encounter any performance issue if we increase the indexed logs to 30 days (currently, no performance issue) ?

Re: Indexed Log setting in MDS/MLM

PhoneBoy — Tue, 08 Jun 2021 20:02:01 GMT

As I recall, it requires restarting the various management services to take effect, which should not affect traffic passing through gateways.
The system will be using more resources while the extra logs are indexed, but it's primarily done at lower priority so if something else requires the system's attention, the reindexing task will be de-prioritized.
Once the reindexing is complete, resource usage should return to normal.

Re: Indexed Log setting in MDS/MLM

RAJ30_AZ — Wed, 09 Jun 2021 07:17:58 GMT

Hi,

Thanks, i understood from the system resource point of view. I still need to understand exactly what are the services needs to be restarted though no impact to users traffic. As we have a strict change process, we have to list all the steps so can you pls share me relevant SK or document ? If not, a brief about what services should be restarted ? Thank you

Re: Indexed Log setting in MDS/MLM

G_W_Albrecht — Wed, 09 Jun 2021 07:55:10 GMT

sk164054: Daily logs retention policy configuration instructions

sk117317: How to configure log/Indexes maintenance policy for Global SmartEvent and MDS

Restarting by

mdsstop

mdsstart

Re: Indexed Log setting in MDS/MLM

PhoneBoy — Wed, 09 Jun 2021 23:37:13 GMT

The services that need to be restarted are on the management, and it looks like all of them, given we're talking about a cpstop/mdsstop.
Assuming gateways log to the management server, the only impact to the gateways is they will temporarily log to the local system.
Once management comes back up, these logs will flow back to the management automatically.

Re: Indexed Log setting in MDS/MLM

RAJ30_AZ — Thu, 10 Jun 2021 09:01:26 GMT

Thanks all for the clarification. I will plan the activity in the next weekend and post you incase if i do face any problems. thanks again

Re: Indexed Log setting in MDS/MLM

RAJ30_AZ — Fri, 18 Jun 2021 12:09:54 GMT

Hi,

We changed the indexed log setting from 14 to 30days on MLM a few days back and followed by mdsstop;mdsstart on MLM.

But the new setting has reflected only at MLM level and not at CLM. Each log servers within the domain is still showing as 14 days. This week, we are planning to restart the services on both primary/backup MDS servers.

Can you please confirm if something else is required here ? Thanks in advance.

Re: Indexed Log setting in MDS/MLM

PhoneBoy — Mon, 21 Jun 2021 01:09:47 GMT

I assume a similar change would have to be made on each log server as each log server indexes.

Re: Indexed Log setting in MDS/MLM

RAJ30_AZ — Mon, 21 Jun 2021 11:26:04 GMT

Hi,

All the domain log servers are set to inherit the settings from MLM servers. Hence, i am suspecting reloading each log server may not required here. We will try to restart mds services on both primary/secondary MDS and if that doesn't help then probably will have to open a case. If you guys know the details, please share me. Thank you

Re: Indexed Log setting in MDS/MLM

Shay_Hibah — Mon, 21 Jun 2021 13:50:05 GMT

Hey,

Once you change the maintenance / log retention configuration, there is a need of "publish" operation on MDS/MLM domain and "install database" on CLA/CLM level.

Once its done, FWD process is reloaded.

No impact on performance or restart / reboot of anything else.