Security Compliance
How to disable the Timeline Analysis Feature in ARM
This article explains how to disable the Timeline Analysis Feature in cases that the ARM database is growing very fast.
First published date
Last published date
Overview
- Sometimes after an update to ARM 2020.2 the ARM database starts to grow very fast.
- For certain reasons (e.g. running SQL Server Express Edition) this can become problematic.
Product section
Cause
- If the ARM database is growing very fast in the background, a most probable reason can be the Timeline Analysis feature accessible from the ARM web portal. More information on the feature can be found here.
- The feature can double the information collected from all loggas to be able to view them in the ARM web portal.
Resolution
Run the following report to check the biggest table in the ARM database.
- Open the SQL Server Management Studio (SSMS).
- Right-click the ARM database.
- Navigate to Reports > Standard Reports.
- Click Disk Usage by Top Table.
Changing the retention settings for timeline events
If it has to do with the dbo._timeline_events you can set the retention settings to the minimum (7 days) for the timeline events in ARM Config > Server > Storage of scans as shown below. Also check the other retention settings to be able to save as much space in the database. According to the retention policies, the database will be cleaned up every day at 5:00 AM by default with the Database Maintenance job. To be able to run this effectively, no ARM clients should be logged in overnight.
Truncating the dbo._timeline_events table
Alternatively, the dbo._timeline_events table can also be truncated by running the following script on the ARM database. Before you Truncate the Table stop the ARM Service first!
-- Scripts are not supported under any SolarWinds support program or service. -- Scripts are provided AS IS without warranty of any kind. SolarWinds further -- disclaims all warranties including, without limitation, any implied warranties -- of merchantability or of fitness for a particular purpose. The risk arising -- out of the use or performance of the scripts and documentation stays with you. -- In no event shall SolarWinds or anyone else involved in the creation, -- production, or delivery of the scripts be liable for any damages whatsoever -- (including, without limitation, damages for loss of business profits, business -- interruption, loss of business information, or other pecuniary loss) arising -- out of the use of or inability to use the scripts or documentation. TRUNCATE TABLE dbo._Timeline_Events
Disabling the Timeline Analysis feature
If you don't use the Timeline Analysis feature then you can also disable it completely by adding the following switches to the pnServer.config.xml file in C:\ProgramData\protected-networks.com\8MAN\cfg folder on the ARM Server, just above the </config>. Save the file and restart the ARM-Service.
<timeline.fsLogga.enabled type="System.Boolean">False</timeline.fsLogga.enabled> <timeline.adLogga.enabled type="System.Boolean">False</timeline.adLogga.enabled> <timeline.exLogga.enabled type="System.Boolean">False</timeline.exLogga.enabled> <timeline.SharePointOnlineLogga.enabled type="System.Boolean">False</timeline.SharePointOnlineLogga.enabled> <timeline.OneDriveLogga.enabled type="System.Boolean">False</timeline.OneDriveLogga.enabled> <timeline.azureLogga.enabled type="System.Boolean">False</timeline.azureLogga.enabled> <timeline.alerts.enabled type="System.Boolean">False</timeline.alerts.enabled> <timeline.logbook.enabled type="System.Boolean">False</timeline.logbook.enabled>