Problems with data input
I have had to reinstall FA yesterday due to loss of data from a significant number of my firewalls. I am running on a dual proc quad core (8 processors available) 16 Gb ram and a pair of 300Gb SAS (RAID 1 Mirror). I was working fine for a few weeks and then I had to turn my data storage down to 1week and 1week so I wouldn't run out of space. A few weeks later, when the app started loosing data I was at ~160GB in the /Firewall directory. I can get to the 160GB mark in about 7 days, then it hovers there as expected.
Upon the reinstall, I changed
JAVA_OPTS="$JAVA_OPTS -Xms128m -Xmx1024m
in the run.sh file and uncommented the 4GB memory statement in start.DB.sh file.
I currently have 11 firewalls pointing at the system. 6 of which are redundant pairs. So I really have 8 primary firewalls. All of my heavy hitters (5) are showing no data received for the selected time period. I have no unparsed records and I have no hardware or OS issues.
TCPDUMP shows that all firewalls are sending data and it is being received by the box.
To get an idea of how much logging I am seeing we can write upwards of 30GB a day in raw Syslog files from my top 3 firewalls. Average about 40GB per day.
As I stated above I was working fine until Tuesday afternoon and then the system dropped all firewalls. Upon a service restart, I got some of my firewalls back but my heavy hitters are all not showing any data received.
Upon the reinstall, I changed
JAVA_OPTS="$JAVA_OPTS -Xms128m -Xmx1024m
in the run.sh file and uncommented the 4GB memory statement in start.DB.sh file.
I currently have 11 firewalls pointing at the system. 6 of which are redundant pairs. So I really have 8 primary firewalls. All of my heavy hitters (5) are showing no data received for the selected time period. I have no unparsed records and I have no hardware or OS issues.
TCPDUMP shows that all firewalls are sending data and it is being received by the box.
To get an idea of how much logging I am seeing we can write upwards of 30GB a day in raw Syslog files from my top 3 firewalls. Average about 40GB per day.
As I stated above I was working fine until Tuesday afternoon and then the system dropped all firewalls. Upon a service restart, I got some of my firewalls back but my heavy hitters are all not showing any data received.