I am not sure if my problem si related with critical issue nr. 833710 ...
|Reference Number||Related Article||Issue Description|
|833710||Issue: Query to fetch data times out on the dashboards when the events count more than 1000.|
After few days, I lost any events data in dashboards. But the events are in DB and can be analysed via RealTime Threats Analyser
Am I correct that this empty dashboard is just result of too many events reaching limit of 1000 ?
Is there any proposed sollution/workaround ?
There are a couple different causes of the issue you are seeing. The issue you linked is a browser related issue and can be mitigated by using either chrome or firefox.
However, since the top attacks table is empty I suspect you are seeing something different.
Check this KB to see if you have a trigger in place that updates the associated sub tables: http://kc.mcafee.com/corporate/index?page=content&id=KB78468
If the trigger is in place, it's worth checking if there are any "ERROR" entries in dbconsistency.log in the <path>/App/ directory.
This log file is created when the installer is run and will indicate if there are any problems in the database. There is a stored procedure used for each of the tables in the dashboard.
If these are indicated as missing in the logs you will either need to try to manually recreate them or try rolling back and upgrading again.
Big thx gfergus1 !
Sollutions described in KB78468 solve our problems. There were no trigges, so I recreated them from dashboard.sql.
Strange is that all our troubles started when Automatic DB tunning was run for first time. Such task corrupted Alerts detail, so we turned this feature off but then we have such troubles with No matching data in dashboards.
Again, big thnx to you and have a nice day.