Database Operations
Introduction
The Database Operations module in GFI EventsManager provides advanced functionality allowing administrators to:
• Centralize events collected by other remote GFI EventsManager instances into one database backend.
• Optimize GFI EventsManager performance by actively controlling database backend growth hence keeping it in good shape.
Why is there a need for database maintenance?
Periodical database maintenance is essential in preventing excessive data growth in the database backend. A database which is large in size drastically affects the performance of GFI EventsManager; events browsing will be slower and queries will take longer to execute. There will also be a negative impact on GFI EventsManager ReportPack performance, with reports taking longer to be generated.
Through GFI EventsManager a number of database operations, referred to as maintenance jobs, can be carried out on the database backend. These include:
• Move to database – Use this operation to move events from the main database to the backup database or to another existing database.
• Export to file – Use this operation to export events from the main database to a compressed binary file which can also be encrypted and backed to CD/DVD or tape for safekeeping.
• Import from file – Use this operation to import events from GFI
EventsManager export files into the main database backend.
• Delete data – Use this operation to remove events from the main or backup database backends.
For each of these operations, you can also apply filters that determine which events will be affected by the database operation.
80
• 8BDatabase Operations
GFI EventsManager
Consolidation of events for a WAN
Figure 1: Consolidation of events for a WAN
In the case of organizations with remote geographical sites, Database
Operations can be used to consolidate all or part of the events data collected in remote sites on to one central database. This is achieved using the ‘Export to file’ feature through which GFI EventsManager compresses and encrypts the file as well as export the file to be processed to a central location. The ‘Import to file’ job is executed at the central location, importing the events from the remote site into the central database.
Events for the remote site can then be viewed through the Events
Browser. Reports with information relevant to the remote site can also be generated using data from the central database.
Configuring Database Operations
With GFI EventsManager you can schedule maintenance jobs to be executed on a specific day, at a specific time and at specific intervals.
GFI EventsManager 8BDatabase Operations
• 81
Screenshot 77 – Configuring Database Operations
NOTE: Database maintenance operations may require high utilization of resources which can degrade server and GFI EventsManager performance. Thus, it is recommended that you schedule maintenance jobs to be executed after office hours. This allows you to maximize the availability of your system resources during working hours and avoid any possible disruptions to workflow.
To configure Database Operations:
1. Click on the Configuration option.
2. From the secondary options bar which opens underneath, select
Options.
3. From the left pane, right-click on the Database Operations node and select Properties. This will bring up the ‘Database Operations
Options’ dialog.
82
• 8BDatabase Operations
GFI EventsManager
Screenshot 78 – Database Operations Options dialog: GFI EventsManager unique identifier
4. Specify the unique identifier by which this instance of GFI
EventsManager will be identified on the network. This identifier is used as part of the export file-name during ‘Export to file’ operations.
Screenshot 79 - Database Operations Options dialog: Scheduling options
5. Click on the Schedule tab to specify:
• Hours of the day during which maintenance jobs can be executed
GFI EventsManager 8BDatabase Operations
• 83
• The interval in hours/days with which maintenance jobs will be executed
• The scheduled date/time when maintenance jobs will start being executed.
Creating maintenance jobs
To create a new maintenance job:
1. Click on the Configuration option.
2. From the secondary options bar which opens underneath, select
Options.
3. From the left pane, right-click on the Database Operations node and select Create new job… This will bring up the ‘New job wizard’.
4. As soon as the welcome dialog is displayed, click on the Next button to bring up the ‘Job Type’ dialog.
Screenshot 80 - New job wizard: Job Type dialog
5. Select the type of maintenance job you want to create and click
Next to proceed to the configuration dialog.
6. Specify the required parameters and click Next to proceed to the data filter configuration dialog.
NOTE: For information on how to configure the parameters of a particular maintenance job, refer to the relevant section in this chapter.
84
• 8BDatabase Operations
GFI EventsManager
Screenshot 81 – Data filter dialog: Specifying data filter conditions
7. Specify which data will be filtered from your database backend. If no filter is specified, the selected maintenance job will affect all data within your database backend. Click Next to continue.
NOTE: For more information on how to configure filter conditions, refer to the section ‘Configuring data filter conditions’ in this chapter.
Screenshot 82 - Specify when the job will be executed
8. Specify whether the selected maintenance job should be scheduled or executed immediately.
NOTE 1: Scheduled jobs are executed according to interval settings configured in the ‘Database Operations’.
NOTE 2: Selected maintenance jobs will be executed only once.
GFI EventsManager 8BDatabase Operations
• 85
9. Click Finish to finalize your configuration settings.
Screenshot 83 - Progress and successful completion of a maintenance job
Move to database
To create a maintenance job which moves events between the main database and any other target database:
1. Launch the ‘New job wizard’ dialog; select the Move to database option.
Screenshot 84 - New job wizard: Move to database
2. Specify the database to which events will be moved. This should be either the backup database or another accessible database on the
SQL Server hosting the main database.
3. Specify the frequency in hours/days at which events will be moved from the main database.
4. Click Next to bring up the data filter conditions dialog.
5. Configure the data filter conditions that will be applied for the ‘Move to database’ job. If you do not set any data filter conditions, than all events older than the specified period will be moved. Click Next to continue.
86
• 8BDatabase Operations
GFI EventsManager
NOTE: For more information on how to configure filter conditions, refer to the section ‘Configuring data filter conditions’ in this chapter.
6. Specify whether the maintenance job should be scheduled or executed immediately.
7. Click on Finish to finalize configuration of the new ‘Move to database’ job.
Export to file
To export events from the main database to a binary file:
1. Launch the ‘New job wizard’ and select the Export to file option.
Screenshot 85 - New job wizard: Export to file
2. Specify the target folder where the exported file will be stored. Use the UNC notation to specify remote paths.
NOTE: Ensure that GFI EventsManager has administrative rights over the specified target folder.
3. Specify the frequency in hours/days at which events will be exported from the main database.
4. Click Next to bring up the data protection dialog.
GFI EventsManager 8BDatabase Operations
• 87
Screenshot 86 - New job wizard: Export to file using encryption
5. Define whether the exported events data will be encrypted, specify the password to be used for decryption and click Next to proceed to the data filter dialog.
NOTE 1: It is recommended that files to be exported are always encrypted using strong passwords.
6. Configure the data filter conditions that will be applied for ‘Export to file’ jobs. If you do not set any data filter conditions, than all events older than the specified period will be exported. Click Next to continue.
NOTE: For more information on how to configure filter conditions, refer to the section ‘Configuring data filter conditions’ in this chapter.
7. Define whether the maintenance job should be scheduled or executed immediately.
8. Click on Finish to finalize your settings.
Export filename
The convention used by GFI EventsManager to name the export file is shown and described below:
[ESM ID]_[Job ID]_[Date From]_[Date To].EXP
• ESM ID – refers to the unique identifier given to each GFI
EventsManager instance running in the organization. job created.
• Date From – refers to the date of the earliest event exported.
• Date To – refers to the date of the latest event exported.
• .EXP – this is the file extension given to all export files.
The following is an example of an export filename:
SERVER01_0051_20061020_20061025.EXP
88
• 8BDatabase Operations
GFI EventsManager
Import from file
To import events from a file into the main database:
1. From the ‘New job wizard’ dialog, select the Import from file option.
Screenshot 87 - New job wizard: Import from file
2. Specify the folder where the export file is stored. Use the UNC notation to specify remote paths.
NOTE 1: Ensure that GFI EventsManager has administrative rights over the specified folder.
NOTE 2: GFI EventsManager will import all files having a .EXP extension.
3. Click Next to proceed to the data protection dialog.
GFI EventsManager 8BDatabase Operations
• 89
Screenshot 88 - New job wizard: Import from file decryption
4. Specify the password with which events data will be decrypted and click Next to proceed to the data filter dialog.
NOTE: Use the same password used for the encryption of your events data.
5. Configure the data filters that will be applied against the imported file and click Next to continue.
NOTE 1: Use data filters to define which events will be imported into the main database.
NOTE 2: For more information on how to configure filter conditions, refer to the ‘Configuring data filter conditions’ section in this chapter.
6. Specify whether the maintenance job should be scheduled or executed immediately.
7. Click on Finish to finalize your settings.
NOTE: GFI EventsManager will change the file extension of all successfully imported files from .EXP to .IMP.
Delete data
To remove events from the main database:
1. From the ‘New job wizard’ dialog, select the Delete data option.
NOTE: Important events data should be backed up through the ‘Move to database’ or ‘Export to file’ maintenance jobs. Failure to do this means that deleted records can NOT be recovered.
90
• 8BDatabase Operations
GFI EventsManager
Screenshot 89 - New job wizard: Delete data
2. Specify whether events will be deleted from the Main database or from the Backup database.
3. Specify the frequency in hours/days at which events will be deleted from the main/backup database.
4. Click Next to bring up the data filter conditions dialog.
5. Configure the data filter conditions that will be applied for the
‘Delete data’ job. If you do not set any data filter conditions, than all events older than the specified period will be deleted. Click Next to continue.
NOTE: For more information on how to configure filter conditions, refer to the section ‘Configuring data filter conditions’ in this chapter.
6. Specify whether the maintenance job should be scheduled or executed immediately.
7. Click on Finish to finalize configuration of the new ‘Delete data’ job.
Configuring data filter conditions
Use data filter conditions to specify which events will be affected by the maintenance job. Only events which match the specified criteria will be processed, moved, exported, deleted or imported.
Filters can be created for one or more of the following log types:
• Windows Event Logs
GFI EventsManager 8BDatabase Operations
• 91
Screenshot 90 – Data filter dialog
To specify which events are affected by maintenance jobs, click on the
Filter button in the data filter dialog. This dialog is available through the ‘New job wizard’.
Example: Windows Event Logs filter
Export events from the Windows Event Logs with the following conditions:
• Log type: Security
• Event ID:
540 – Successful logon
• User:
administrator
• Event Type: Error.
Configure your filter parameters as shown in the ‘Edit filter’ dialog shown below:
92
• 8BDatabase Operations
GFI EventsManager
Screenshot 91 - Creating a filter for Windows events: Edit filter dialog
Choose Ok to finalize filter configuration.
Advanced conditions
Screenshot 92 - Advanced Filter settings
GFI EventsManager 8BDatabase Operations
• 93
From the ‘Edit filter’ dialog you can also set advanced filter conditions.
Through this dialog you can also create and apply filters on all events data fields used by GFI EventsManager.
Note: Filters can also be applied on maintenance jobs after they have been created. For more information refer to the ‘Editing a maintenance job’ section.
Viewing scheduled maintenance jobs
Screenshot 93 - Viewing scheduled maintenance jobs
To view maintenance jobs created:
1. Click on the Configuration option.
2. From the secondary option bar, select Options.
3. From the left pane, select the Database operations node.
4. The list of scheduled maintenance jobs are available in the right pane.
94
• 8BDatabase Operations
GFI EventsManager
Job activity status
Screenshot 94 - Job activity status
The progress of maintenance jobs that are being processed can be viewed through the status monitor:
1. Click the Status option from the primary options bar.
2. Select the Job Activity dashboard view.
3. View the status of maintenance jobs in the Maintenance Jobs section of the dashboard.
Editing a maintenance job
You can make changes to maintenance job parameters for jobs scheduled.
1. Click on the Configuration option.
2. From the secondary option bar, select Options.
3. From the left pane, select the Database Operations node.
4. From the right pane, right-click on the maintenance job to edit and select Properties.
Screenshot 95 - Example dialog to edit a scheduled job
5. Configure the required parameters as described in the sections above:
GFI EventsManager 8BDatabase Operations
• 95
o
file locations or databases o
frequency in hours/days.
Editing a maintenance job priority
Screenshot 96 - Maintenance job priorities
When maintenance jobs are created, it is given a priority setting. Job priorities are set according to the sequence with which the jobs are created. The first job created is given a priority setting of 1, the second job created is given a priority setting of 2, and so on. The priority determines the sequence in which jobs are executed.
To increase or decrease the priority of a maintenance job:
1. Click on the Configuration option.
2. From the secondary option bar, select Options.
3. From the left pane, select the Database Operations node.
4. From the right pane, right-click on the maintenance job to change and select Increase Priority or Decrease Priority as required.
Deleting a maintenance job
Scheduled maintenance jobs awaiting execution can also be deleted.
1. Click on the Configuration option.
2. From the secondary option bar, select Options.
3. From the left pane, select the Database Operations node.
4. From the right pane, right-click on the maintenance job to delete and select Delete.
96
• 8BDatabase Operations
GFI EventsManager
NOTE: Due diligence should be taken when deleting maintenance jobs for such an operation has an indirect effect on events data. An example is an ‘Export to file’ maintenance job with a higher priority than a ‘Delete data’ job. If you delete the ‘Export to file’ job, one may end up with events data being removed without having any backup of such data.
GFI EventsManager 8BDatabase Operations
• 97
