I have a pair of managers configured for MDR. I have recently noticed that there is a big difference in the size of the database between the primary and secondary managers.
The database on the primary manager is around 20 GB larger than the database on the secondary manager. I don't expect the databases to be exactly the same size, but this seems like there might be a problem with one of the managers.
The managers were both upgraded to 8.2 earlier in the year and at that time I purged the databases on both managers. The managers were upgraded within two hours of each other so should contain nearly the same amount of data.
Any help is appreciated.
This was due to the fact that MDR synchronization only sync's the last 24 hours or 10,000 alerts. If you are generating large volumes of alerts and have a manager off line for a few days it will not replicate all alerts when it comes back on line.