Advanced Threat Analytics (ATA) Center disk usage

Fahad Noaman 131 Reputation points
2020-09-14T12:19:32.387+00:00

we have added disk size based the ATA sizing tool result to ATA center server, but disk size is increasing rapidly without overwriting the old log data.

can you help to delete unwanted data from the ATA center server.

Microsoft Configuration Manager
0 comments No comments
{count} votes

Accepted answer
  1. Eli Ofek (MSFT) 911 Reputation points Microsoft Employee
    2020-09-15T08:31:08.657+00:00

    It looks like the sizing of the center (both disk space and cpu/memory) are low compared to the actual traffic getting in.
    What was the spec recommended by the sizing tool and what was deployed effectively?
    was the sizing tool ran for 24 hours covering a full working day?
    Any errors in the sizing tool complaining that maybe it failed visibility to some of the DCs (thus missed traffic) ?

    In some cases the tool can be off, it's heuristics based on past customer experience, but for some environments you might need to bump the spec up .
    If the sizing tool did not report any issues, and hardware was deployed according to recommendation, I suggest to open a support case so the engineer can inspect the data collectors to see what is holding back the center, and if indeed we need to add more hardware in this case.


2 additional answers

Sort by: Most helpful
  1. Eli Ofek (MSFT) 911 Reputation points Microsoft Employee
    2020-09-14T20:02:59.847+00:00

    The center is configured to stabilize on min(200GB, 20% of disk space)
    https://learn.microsoft.com/en-us/advanced-threat-analytics/ata-capacity-planning#ata-center-sizing

    So if you keep adding space, it will continue to grow.
    Once free space will go below min(200GB, 20% of disk space) auto trimming will take effect.


  2. Fahad Noaman 131 Reputation points
    2020-10-01T08:24:58.433+00:00

    Update 3 has the fix for this issue.

    0 comments No comments