cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
wroche
Level 7
Report Inappropriate Content
Message 1 of 3

How to report on a storage usage spike

Due to not enough \opt disk space an update was stopped. I can observe the spike of about 20 GB within a 15 minute time frame via the GUI: File System Availability and Traffic Per Protocol graphs.FileSystemAvailability.JPGTrafficPerProtocol.JPG

How may I best perform a discovery report in CSR that shows the cause of the spike activity?
We currently have a report named: Top Web Bandwidth Consumption Usage by IP Address and Site
It has configuration for: 
Multi-Group Summary Table
Sum of Bytes (show total)
Labels: IP Address, Site
Filter: by time

The results of the report showed a specific user, on a specific endpoint, performed a file download of 3.5 GB and that is nowhere near the 20 GB spike.

Suggestions?

2 Replies
smasnizk
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 3

Re: How to report on a storage usage spike

Dear @wroche 

 

please keep in mind that the Download size of 3.5 GB is most likely an archive package and the job of MWG is to extract all files to scan each file individually. In ration 1:10 the file size will become 35GB of extracted file. This should explain quick raise of Disk space usage. 

 

My suggestion would be to resize /opt partition to address this. Please follow our Best Practice Article:
https://community.mcafee.com/t5/Enterprise-Documents/Web-Gateway-Resizing-the-partitions/ta-p/554184

You might also notice this file will require very long time for scanning which also can decrease your MWG performance and lead to CPU spike. This is normal behaviour as the aim of MWG is to deliver best possible result in short possible amount of time. If those kind of updates are normal I would suggesting to perform scans either on Endpoint device or trust this vendor not sending you infected updates. 

 

Best Regards,
Sergej


If you find this post useful, Please give it a Kudos! Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!
jacek
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 3 of 3

Re: How to report on a storage usage spike

Do you know, you can monitor /opt free space using real time notification? MWG can send email, send SNMP traps, create syslog entries.
Policy - Rule Sets - Error Handler:
Default - Monitoring - Check Cache Partition

If you cannot see "Monitoring", add it from Library (Add - Rule Set from Library - Error Handling - Monitoring).
By default, this event is triggered by 95% usage, which you can adjust to your needs.
You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community