Partitions Tab

The Sentinel database is partitioned by time to simplify maintenance and improve the performance of the database. The Partitions tab in the SDM allows users to view and manage database partitions for the tables that hold event data, correlated event data, and summary data.

To view partitions in the GUI:

  1. Click the Partitions tab.

  2. Select the table in the dropdown list you would like to see.

SDM displays the partitions of the currently selected Database Table.

Each row in the Segments table displays the related Database Table, Time Range, Status and Name of the partition.

The Status of each of the partitions shown in the Segments table will have one of the following states:

Online

Partition with data that is available for access

Online Current

Partition to which events are currently getting inserted

Online Archived

Partition with data that has been archived but is still accessible because the partition has not been dropped

Offline Archived

Partition with data that has been archived and then dropped from the database

Online Archived Imported

Partition with data that has been archived, dropped from the database, and then re-imported into the database

NOTE: If you delete a partition without archiving it, it is deleted from the partition list in the GUI.

image\ebx_1571224335.gif

At the bottom of the Partitions tab, there are several smaller tabs that allow the user to perform the following operations:

Many of these operations can be executed automatically in the database using stored procedures, but this tab allows the administrator to perform these tasks manually.

To manage partitions:

  1. Click the Partitions tab.

  2. Select the table in the dropdown list.

NOTE: Sentinel partitioned tables are organized into 2 groups. One is the EVENTS table group, which includes EVENTS and CORRELATED_EVENTS; the other is the summary table group, which includes all summary, or aggregate, tables. If any one of the tables in the group is selected then the changes will apply to all the tables in the group.

  1. Select the tab in the bottom of the window that relates to the operation that you would like to perform – Add, Delete, Archive, Import or Release.

To add partitions:

  1. Select the Add partitions tab.

  2. Specify the number of days over which to add the partitions.

NOTE: You can specify the number of partitions in Partition Configuration in SDM GUI.

  1. Click Add.

To delete partitions:

  1. Select the Delete partitions tab.

  2. Specify the number of days for which older partitions will be deleted.

  3. Click Delete.

To import partitions:

  1. Select the Import partitions tab.

  2. Select the partition in the Segment table into which the data will be imported.

NOTE: You can specify the input directory in the "Archive Destination" field in Partition configuration tab in SDM GUI.

  1. Click Import.

To release imported partitions:

  1. Select the Release partitions tab.

  2. Select the partition in the Segment table that will be released.

  3. Click Release.