Reply to Message

View discussion in a popup

Replying to:
ccalvetbeta
Enthusiast
Enthusiast

Hi,
I have a similar issue. vCloud director "database full".

In my case the table "audit_trail" in the "vcloud" database in vCloud director postgres database is now 160 GB. Database size has been increased multiples time but this can't be the solution in long term vision.
Stopping the vAPPs associated to the Tanzu kubernetes cluster "beta" stops the generation of new logs.

I see also many "Access token created ..." events but i am not sure if they are related to beta or legacy CSE clusters.
But i think the ones consuming the largest amount of data are the events of type "definedEntity/modify ''beta006'' (9ebee87d-9d05-4c3f-b8e7-01ea477ac48c)"   - beta006 is one of the cluster create with CSE beta.
Because the Details are very large. See attached file.


Solution attempted so far:
I have already reduced in "Administration">"General settings">"Activity logs", logs history to keep and shown to 20 days but it doesn't seem that the entries older than 20 days in audit_trail are removed.
I guess there is a script responsible for cleaning old events, if it is the case and someone knows how to manually start it please let me know.
I am not even sure if it could work because i was in the assumption these settings works with the "audit_event" table, and when i was looking at row there, there are none in this table.

Questions:
Is it expect that cluster created with CSE beta will create events and therefore many rows in "audit_trail" database?
(Note, it is possible that cloud director is/was configured with advanced settings i am not aware, like adding extra logging during a previous support call)
What is the best way of cleaning the "audit_trail" database?
Are "Activity logs" settings supposed to have an impact on the "audit_trail" table? If yes, how to manually start the cleaning script?
What would be the impact of deleting the oldest rows using SQL commands against "audit_trail"?
If it could be done without breaking Cloud DIrector it would be an easy workaround.



Reply
0 Kudos