During regular maintenance at a customer we noticed the Ivanti WorkSpace Control logging database was getting quite big. The logging database had reached a size of more than 1TB, something of which the cause was not immediately clear. Sure they had lots of users and were keeping lots of auditing data, but the increase in database size couldn’t be related to additional users or something else.
We contacted Ivanti Support to investigate the huge increase in logging database size. They told me about a useful tool called “Workspace Manager Logging Management Tool“. The tool was created by a former employee Patrick van Grinsven. Soon it became clear what exactly was using so much space within the logging database.
Sampling Mode was by far using most space within our logging database. Initially we tried to delete the Sampling Mode data from within the Ivanti Workspace Control Console, but there was just to much data. The console crashed repeatedly and wasn’t able to do the cleanup anymore.
Deleting the records can be done with the Workspace Manager Logging Management Tool, but the amount of records was so much we decided to run all cleaning on the SQL server itself. Ivanti has an extensive support article, which describes how to clean specific type of records from the tbllogs table.
HOWTO: Clear certain entries from the tbllogs table in an Ivanti Workspace Control Database
It took us several days to cleanup almost 550 million records of Sampling mode data from dbo.tblLogs (delete from dbo.tblLogs where lngClassId = 48). Soon as all Sampling mode data was deleted we reanalysed the logging database again, but found it was still quite large. This time we noticed several components, like “General Errors Log” & “User Event Logs : Session Refresh” were consuming lots of database space.
Initially we thought this would be normal because of the huge number of users we served in combination with a retention time of 90 days. After some further analysis we discovered that data older then 90 days was still retained within the logging database.
select count(*)
from dbo.tblLogs WHERE strDateTimeUTC <= (SELECT CONVERT(VarChar(20), DATEADD(dd, -90,GETDATE()), 112)) and lngClassId = 46
This was strange because the database was configured to cleanup data older than 90 days.
At first we thought it could have been caused by the huge database we had before, so we cleaned all records older than 90 days manually.
Normally the process to remove obsolete logs files would run once a day at a pre configured time. When a user starts a session, Ivanti Workspace Control will check whether it has already performed a cleanup that day. I our case the agents don’t have direct database access and connect through a Relay Server. In this case the Relay Servers will take over the housekeeping and perform the daily maintenance. We double checked if Relay Server where per accident excluded from housekeeping (HKEY_LOCAL_MACHINESOFTWARERESWorkspace ManagerRelayServer RemoveObsoleteLogFiles), but all Relay Servers were allowed to do the removal of obsolete log files
HOWTO: Exclude an RES ONE Workspace Relay Server from daily cleanup of obsolete log files
We could clean up the old log files by manually starting the process. Administration > Maintenance > Clean up logs now > Go
The maintenance process found lots of records which should have been deleted automatically
Ivanti support discovered there was a problem with the Relay Server, which caused the obsolete log files not being cleaned correctly. The issue was solved in WorkSpace Control 10.3.500.0 which was released recently. We upgraded all of our Relay Server and no obsolete log files exists within the database anymore
Logging database contains obsolete logging data | Ivanti User Community
Ivanti Workspace Control 10.3.50.0
Software download
Release notes