Configuring Log Database options

Administrator Help | Forcepoint Email Security | Version 8.5.x

The Log Database stores the records of email traffic activity and the associated email analysis on that traffic. These data records are used to generate presentation reports of email activity, including size and volume of email messages and identification of senders and recipients. They are also used to generate the status charts on the dashboard.

Administering the Log Database involves controlling many aspects of database operations, including the timing of maintenance tasks, the conditions for creating new database partitions, and which partitions are available for reporting. Manage Log Database operations on the page Settings > Reporting > Log Database.

Making changes to Log Database settings on one appliance applies those changes to all the appliances in your network.

The Log Database page is divided into six sections, as detailed in the following table. After making changes in any of these sections of the Log Database page, click the OK button within the section to save and implement the changes in that section.


Parameter	Description
Log Database Location	Provides options to configure the IP address/instance or hostname/instance of your Log Database server. By default, the Log Database created at installation is entered. See Configuring the Log Database location.
Database Rollover Options	Provides options to specify when you want the Log Database to create a new database partition, a process called a rollover.
Maintenance Configuration	Provides options to configure aspects of database processing, such as the time for running the database maintenance job, some of the maintenance tasks performed, and deletion of database partitions and error logs. See Configuring maintenance options.
Database Partition Creation	Provides options to define characteristics for new database partitions, such as location and size options. This area also lets you create a new partition right away, rather than waiting for a planned rollover. See Creating database partitions.
Available Partitions	Lists all database partitions available for reporting. The list shows the dates covered by the partition, as well as the size and name of each partition. Use this list to control what database partitions are included in reports, and to select individual partitions to be deleted.
Log Activity	Displays log activity to review database maintenance status and event and error messages recorded during the jobs run on the Log Database. See Viewing log activity.

Configuring the Log Database location

Use the section Log Database Location on the page Settings > Reporting > Log Database to enter the IP address\instance or hostname\instance of your Log Database server. By default, the Log Database created at installation is entered. If you chose to encrypt the database connection at product installation, the Encrypt connection check box is marked. If you did not select the encryption option during installation, you can encrypt the database connection by marking the check box here.


	Important You must have imported a trusted SSL certificate to the Log Server machine in order to use SSL for the encryption option. See your database documentation for information about importing a trusted certificate.

Other settings created at installation and displayed here include the designated authentication method (Windows or SQL Server), user name, and password.

Determine the availability of the server

From the section Log Database Location, click Check Status.

Configuring database rollover options

The top of the Log Database Options section displays the name of the active Log Database and a Refresh link. Click Refresh to update the information shown on the Log Database page. Be sure you save your settings before you click Refresh, because any unsaved changes on the page will be cleared.

Use the Database Rollover Options section of the page Settings > Reporting > Log Database to specify when you want the Log Database to create a new database partition, a process called a rollover.

Use the Roll over every option to indicate whether database partitions should roll over based on size (MB) or date (weeks or months).

For size-based rollovers, select MB and specify the number of megabytes the database must reach for the rollover to begin, from 100–10240 MB (default is 5120).

For date-based rollovers, select either weeks or months as the unit of measure, and specify how many full calendar weeks (from 1–52) or months (from 1–12) to keep in a database partition before a new one is created.


	Note If the rollover begins during a busy part of the day, performance may slow during the rollover process. To avoid this possibility, some environments choose to set the automatic rollover to a long time period or large maximum size. Then, they perform regular manual rollovers to prevent the automatic rollover from occurring. See Creating database partitions for information on manual rollovers. Extremely large individual partitions are not recommended. Reporting performance can slow if data is not divided into multiple, smaller partitions.

When a new database partition is created, reporting is automatically enabled for the partition (see Enabling database partitions).

Click OK to activate changes to the database rollover options.

Configuring maintenance options

Use the Maintenance Configuration section of the page Settings > Reporting > Log Database to control certain aspects of database processing, such as the time for running the database maintenance job, some of the maintenance tasks performed, and deletion of database partitions and error logs.

For Maintenance start time, select the time of day for running the database maintenance job. Default value is 1:00.

The time and system resources required by this job vary depending on the tasks you select in this area. To minimize any impact on other activities and systems, it is best to run this job during a slow email traffic period.

Mark the check box Automatically delete a partition with an end date older than, and then specify the number of days (from 1 to 365) after which partitions should be deleted (default is 365).


	Warning After a partition has been deleted, the data cannot be recovered. See Enabling database partitions for an alternative way to delete partitions.

Mark the check box Enable automatic reindexing of partitions on, and then select a day of the week to have this processing performed automatically (default is Saturday).

Reindexing the database is important to maintain database integrity and to optimize reporting speed.


	Important It is best to perform this processing during a quiet time for email traffic. Reindexing database partitions is resource intensive and time consuming. Reports should not be run during the reindexing process.

Mark the check box Delete failed batches after and then enter a number of days (from 1 to 365) after which to delete any failed batches. Default value is 20.

If this option is not checked, failed batches are retained indefinitely for future processing.

If there is insufficient disk space or inadequate database permissions to insert log records into the database, the records are marked as a failed batch. Typically, these batches are successfully reprocessed and inserted into the database during the nightly database maintenance job.

However, this reprocessing cannot be successful if the disk space or permission problem is not resolved. Additionally, if the Process any unprocessed batches option is not selected, failed batches are never reprocessed. They are deleted after the time specified here.

Mark the check box Process any unprocessed batches to have the nightly database maintenance job reprocess any failed batches.

If this option is not checked, failed batches are never reprocessed. They are deleted after the time specified in step 4, if any.

Mark the check box Delete the log after, and then enter a number of days (1 to 120) after which to delete database error records. Default value is 45.

If this option is not checked, error logs are retained indefinitely.

Click OK to activate changes to the maintenance configuration options.

Creating database partitions

Database partitions store the individual log records of email traffic activity. Microsoft SQL Server users can configure the Log Database to start a new partition based on partition size or a date interval.

When partitions are based on size, all incoming log records are inserted into the most recent active partition that satisfies the size rule. When the partition reaches the designated maximum size, a new partition is created for inserting new log records.

When the partitions are based on date, new partitions are created according to the established cycle. For example, if the rollover option is monthly, a new partition is created as soon as any records are received for the new month. Incoming log records are inserted into the appropriate partition based on date.

Database partitions provide flexibility and performance advantages. For example, you can generate reports from a single partition to limit the scope of data that must be analyzed to locate the requested information.

Use the Database Partition Creation section of the page Settings > Reporting > Log Database to define characteristics for new database partitions, such as location and size options. This area also lets you create a new partition right away, rather than waiting for a planned rollover.

Enter the file path for creating both the data and log files for new database partitions.

Under Initial Size (MB), set the initial file size (from 100 to 2048 MB) for both the Data and Log files for new database partitions.


	Note Best practice recommends calculating the average partition size over a period of time. Then, update the initial size to that value. This approach minimizes the number of times the partition must be expanded, and frees resources to process data into the partitions.

Under Growth (MB), set the increment by which to increase the size (from 8 - 512 MB) of a partition's data and log files when additional space is required.

Click OK to implement the path, size, and growth changes entered.

Database partitions created after these changes use the new settings.

Click Create to create a new partition immediately, regardless of the automatic rollover settings.

To have the new partition use the changes made in this section, be sure to click OK before you click Create.

Click the Refresh link in the content pane periodically. The Available Partitions area will show the new partition when the creation process is complete.

If you later change the partition file path, you should be sure that the new database folder exists with write privileges.

Enabling database partitions

The Available Partitions section of the page Settings > Reporting > Log Database lists all the database partitions available for reporting. The list shows the dates covered by the partition, as well as the size and name of each partition.

Use this list to control what database partitions are included in reports, and to select individual partitions to be deleted.

Mark the check box in the Enable column next to each partition you want included in reports.

Use the Select all and Select none options above the list, as appropriate.

You must enable at least one partition for reporting. Use the Select none option to disable all partitions at one time so that you can enable just a few.

Use these options to manage how much data must be analyzed when generating reports and speed report processing. For example, if you plan to generate a series of reports for June, select only partitions with dates in June.


	Important This selection affects scheduled reports as well as reports that are run interactively. To avoid generating reports with no data, make sure the relevant partitions are enabled when reports are scheduled to run.

Click the Delete option beside a partition name if that partition is no longer needed. The partition is actually deleted the next time the nightly database maintenance job runs.


	Warning Use this option with care. You cannot recover data from deleted partitions.

Deleting obsolete partitions minimizes the number of partitions in the Log Database, which improves database and reporting performance. Use this Delete option to delete individual partitions as needed. See Configuring maintenance options if you prefer to delete older partitions according to a schedule.

Click OK to activate changes to the available partitions options.

Viewing log activity

Use the Log Activity section of the page Settings > Reporting > Log Database to review database maintenance status and event and error messages recorded during the jobs run on the Log Database. Use the View pull-down menu to select the maximum number of messages to display.