4.6 Tuning Antimalware Database Synchronization

The ZENworks database syncs data--such as devices, policies, assignments, and configuration settings--to the Antimalware database. With this synced data and the malware event data received directly from devices, ZENworks Control Center only has to query the Antimalware database when displaying Antimalware data.

Antimalware database synchronization is implemented through an Apache Kafka Change Data Capture (CDC) workflow that streams data from the ZENworks database to the Antimalware database. This workflow is documented in detail in the Kafka Reference Guide.

Typically, you should not need to tune the Antimalware database synchronization process. The following information is provided for reference if adjustments are required under the direction of Micro Focus support or development when resolving performance issues.

4.6.1 Kafka RDBMS Producer Settings

The Kafka RDBMS producer is responsible for identifying changes in the ZENworks database (RDBMS) tables and publishing those changes to topics in Kafka. The connector-configs.xml file contains the producer settings:

Linux: /etc/opt/microfocus/zenworks/connector-configs.xml

Windows: %ZENSERVER_HOME%\conf\connector-configs.xml

Each synced database table, along with its synchronization settings, is defined in a <connector-config> section of the file. For example, the zvpolicy table is defined as:

<connector-config name="ZENconnector-zvpolicy">
     <config name="poll.interval.ms" value="90000"/>
     <config name="timestamp.delay.interval.ms" value="120000"/>
</connector-config>

This allows independent adjustments to the synchronization frequency of each database table. For example, reducing the poll interval for the zvpolicy database table would cause policy data to be synced more frequently. You should be aware of the following before adjusting settings:

  • Care should be taken to ensure that the poll interval for child tables (such as zvpolicy) is paired with parent tables (such as zenobject). Otherwise, the producer may try to add child data to a topic before its parent data is available in the topic.

  • The Kafka RDBMS producer (and its connectors) publishes data that is consumed by both the Antimalware database and the Vertica database. Changes to the settings affect both consumers.

Setting

Description

poll.interval.ms

The frequency, in milliseconds, to poll for new data in the table. The default is every 90 seconds.

timestamp.delay.interval.ms

How long to wait after a row with a certain timestamp appears before including it in the result. This setting should not be modified.

4.6.2 Kafka Antimalware Consumer Settings

The Kafka Antimalware consumer reads data from the Kafka topics and persists it into the Antimalware database. The antimalware-cdc-consumer-config.xml file contains the consumer configuration settings:

Linux: /etc/opt/microfocus/zenworks/antimalware/antimalware-cdc-consumer-config.xml

Windows: %ZENSERVER_HOME%\conf\antimalware\antimalware-cdc-consumer-config.xml

Each topic (i.e. synced database table), along with its synchronization settings, is defined in a <consumer-config> section of the file. For example, the topic for the zvpolicy table is defined as:

<consumer-config name="antimalware-zvpolicy" topics="zenview.*-zvpolicy" group-id="antimalware-microservice" poll-timeout="10000">
        <kafka-properties>
            <property key="max.poll.records" value="5000"/>
            <property key="max.poll.interval.ms" value="600000"/>
            <property key="session.timeout.ms" value="30000"/>
            <property key="default.api.timeout.ms" value="120000"/>
            <property key="partition.assignment.strategy" value="org.apache.kafka.clients.consumer.RoundRobinAssignor"/>
        </kafka-properties>
        <consumer-properties>
            <property key="mapping.objectname" value="com.microfocus.zenworks.cdc.objects.ZvPolicy"/>
            <property key="filter" value="com.microfocus.zenworks.cdc.filters.AvPolicyFilter"/>
            <property key="processor" value="com.microfocus.zenworks.kafka.processor.SimpleDatabaseDimensionProcessor"/>
            <property key="eq.pkey.field" value="zuid"/>
        </consumer-properties>
    </consumer-config>

Each <consumer-config> section includes both Kafka configuration settings <kafka-properties> and Antimalware consumer configuration settings <consumer-properties> that apply to the synchronization of that section’s topic.

The <consumer-properties> should not be modified.

The <kafka-properties> can be modified if necessary. Refer to the Kafka Consumer Configurations documentation for descriptions of the configuration settings.

4.6.3 Antimalware Database Connections

The Kafka Change Data Capture (CDC) uses a c3p0 library to manage the database connection pool. The table below lists the c3p0 settings that can be adjusted to tune performance. The settings are in the cdc-c3p0.properties file:

Linux: /etc/opt/microfocus/antimalware/cdc-c3p0.properties

Windows: %ZENSERVER_HOME%\services\antimalware\conf\cdc-c3p0.properties

The default values should provide sufficient performance but you can uncomment and change values as necessary. See this c3po documentation for setting descriptions.

Setting

Description

c3p0.min-poolsize

The default is 5.

c3p0.max-poolsize

The default is 20.

c3p0.num-helper-threads

The default is 5.

c3p0.max-statements

The default is 1000.

c3p0.max-statements-per-connection

The default is 100.

c3p0.max-connection-age

The default is 14400.

c3p0.max-idle-time

The default is 3600.

c3p0.max-idle-time-excess-connections

The default is 120.

c3p0.idle-connection-test-period

The default is 600.

c3p0.acquire-increment

The default is 5.

c3p0.acquire-retry-attempts

The default is 30.

c3p0.acquire-retry-delay

The default is 3000.

c3p0.connection-customize

The default is disabled.