Snare Server disk space is low, or the data store is too large

Owned by Carlos Osorio
Nov 12, 2020
1 min read


SUMMARY

Aug 18, 2015

Symptoms
The cumulative data in the data store is too big on the Snare Server.

Recommended:

  1. Connect to the Snare Server via a web browser and log in as the user 'Administrator', or a user with equivalent privileges.

  2. View the Snare Server dashboard, that appears after login, and check the available disk space, or alternatively, check the 'Health Checker' objective under the 'Status' section of the Snare Server.

  3. If data needs to be removed from the Snare Server in order to cut down on disk space utilisation, then there are two courses of action; you can archive the old data to CD/DVD or USB, and/or cut down on the number of events being received by the Snare Server.

  4. CD/DVD/USB Archive: Old event data can be archived onto CD or DVD, or synchronised to a USBKey or USB drive, using the 'Data Backup' objective, found in 'System / Data Backup'.

  5. Collection: The archive objective will only do so much to reduce the amount of information in the data store. It may be necessary to limit the volume of data that reaches the Snare Server, to avoid ongoing space issues. Fortunately, the Snare agents are able to filter information, and hence it is possible to limit the information that is collected. The objectives under the 'Status' section of the Snare Server will be able to assist you in the process of pinning down the more verbose agents. The 'Monitor Live Data' objective, in particular, may assist with the process of tracking down particular events that make up a significant proportion of your data.