Share all details related to your problem, including any error messages you may have received.
As a new maintenance task , we are pruning syslogs only from IIQ UI. We are talking about hours (5-6) to delete data even when doing in small batches with lesser days retrieval. I understand this will be time consuming considering the size of data but we wanted to know if there is any other way? Is there a way to purge using a rule or can someone help me create a custom rule to prune syslogs. Thanks
Hi Nissy,
I understand you are using perform maintenance task to do that right?
Generaly you need to know that the syslog events are not stored “on the host” - they are stored in spt_syslog_events table in the database. That means that when you prune syslog events only on UI servers then you actualy still prune all eligable events but using resources only on this server(s). Here you can see how the data is stored in the database.
Going more into details - for syslog pruning - most important is this setting
it allows you not only turn on and off syslog logging but also allows you to select logging level and time how long will the syslog events stay in the database before being pruned.
Now about pruning - there are 2 options you can use to do that
You can use Perform Maintenance task for that - but as pruning can be slow (you experienced it already) it’s recommended to have separate perform maintenance task only for object pruning to not impact the standard Perform Maintenance responsible for processing events, background workflowcases etc.
in this case you can select Enable partitioning it will distribute pruning tasks across all available partitions improving the process significantly.
You can use different task called System Maintenance Object Pruner which is a bit different task but in the end doing the same operation - pruning objects. The only thing is that you cannot partition it
The fastest, the dirtiest and definitely not recommended solution - you can just shut down IIQ, truncate spt_syslog_events and start it again - it will work very fast but in theory it might cause problems with HBM later so that’s also the reason why it’s not the best idea to do that.
