The Sentinel database is partitioned by time to simplify maintenance and improve the performance of the database. The Partitions tab in the SDM allows users to view and manage database partitions for the tables that hold event data, correlated event data, and summary data.
To view partitions in the GUI:
Click the Partitions tab.
Select the table in the dropdown list you would like to see.
SDM displays the partitions of the currently selected Database Table.
Each row in the Segments table displays the related Database Table, Time Range, Status and Name of the partition.
The Status of each of the partitions shown in the Segments table will have one of the following states:
Online |
Partition with data that is available for access |
Online Current |
Partition to which events are currently getting inserted |
Online Archived |
Partition with data that has been archived but is still accessible because the partition has not been dropped |
Offline Archived |
Partition with data that has been archived and then dropped from the database |
Online Archived Imported |
Partition with data that has been archived, dropped from the database, and then re-imported into the database |
NOTE: If you delete a partition without archiving it, it is deleted from the partition list in the GUI.
At the bottom of the Partitions tab, there are several smaller tabs that allow the user to perform the following operations:
Add empty partitions to the database
Delete partitions from the database
Archive data from partitions to flat files in a specified, pre-existing directory
Import Partitions
Drop Partitions
Many of these operations can be executed automatically in the database using stored procedures, but this tab allows the administrator to perform these tasks manually.
To manage partitions:
Click the Partitions tab.
Select the table in the dropdown list.
NOTE: Sentinel partitioned tables are organized into 2 groups. One is the EVENTS table group, which includes EVENTS and CORRELATED_EVENTS; the other is the summary table group, which includes all summary, or aggregate, tables. If any one of the tables in the group is selected then the changes will apply to all the tables in the group.
Select the tab in the bottom of the window that relates to the operation that you would like to perform Add, Delete, Archive, Import or Release.
To add partitions:
Select the Add partitions tab.
Specify the number of days over which to add the partitions.
NOTE: You can specify the number of partitions in Partition Configuration in SDM GUI.
Click Add.
To delete partitions:
Select the Delete partitions tab.
Specify the number of days for which older partitions will be deleted.
Click Delete.
To import partitions:
Select the Import partitions tab.
Select the partition in the Segment table into which the data will be imported.
NOTE: You can specify the input directory in the "Archive Destination" field in Partition configuration tab in SDM GUI.
Click Import.
To release imported partitions:
Select the Release partitions tab.
Select the partition in the Segment table that will be released.
Click Release.