question

FahadNoaman-7438 avatar image
1 Vote"
FahadNoaman-7438 asked FahadNoaman-7438 answered

Advanced Threat Analytics (ATA) Center disk usage

we have added disk size based the ATA sizing tool result to ATA center server, but disk size is increasing rapidly without overwriting the old log data.

can you help to delete unwanted data from the ATA center server.

ems-advanced-threat-analytics
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Eli-Ofek avatar image
1 Vote"
Eli-Ofek answered FahadNoaman-7438 commented

It looks like the sizing of the center (both disk space and cpu/memory) are low compared to the actual traffic getting in.
What was the spec recommended by the sizing tool and what was deployed effectively?
was the sizing tool ran for 24 hours covering a full working day?
Any errors in the sizing tool complaining that maybe it failed visibility to some of the DCs (thus missed traffic) ?

In some cases the tool can be off, it's heuristics based on past customer experience, but for some environments you might need to bump the spec up .
If the sizing tool did not report any issues, and hardware was deployed according to recommendation, I suggest to open a support case so the engineer can inspect the data collectors to see what is holding back the center, and if indeed we need to add more hardware in this case.

· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Thank you so much for your suggestion, i will raise a case.

1 Vote 1 ·
Eli-Ofek avatar image
1 Vote"
Eli-Ofek answered FahadNoaman-7438 commented

The center is configured to stabilize on min(200GB, 20% of disk space)
https://docs.microsoft.com/en-us/advanced-threat-analytics/ata-capacity-planning#ata-center-sizing

So if you keep adding space, it will continue to grow.
Once free space will go below min(200GB, 20% of disk space) auto trimming will take effect.

· 3
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Auto trimmings is not working it seems.

we have 400 GB space on the disk and usage is above 200 GB or 20% of disk space but still its has not removed the old data.

24755-image.png


1 Vote 1 ·
image.png (113.5 KiB)

it does look weird, it should have stabled on ~80GB free if sizing is correct.

Are there any health issues in the console?

1 Vote 1 ·

yes, we have alert on board.

24707-capture.png


1 Vote 1 ·
capture.png (31.0 KiB)
FahadNoaman-7438 avatar image
1 Vote"
FahadNoaman-7438 answered

Update 3 has the fix for this issue.

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.