SVM Database Issue

[aansari]

Hi All,

We have been trying to integrate a reporting tool(Reporting Server) with SVM.
This tool fetches all of the scan results and then generates reports based on the users requirements.

When testing it with one of our client it was seen that there were 1 million records for past 8 weeks that were being fetched by the reporting server, and the query would time out.

On further checks it was seen that the client was running a daily import with thousands of servers in it. This import was then deleted, along with any other import that had a same host but was grouped differently.

• Currently the client has only 2 imports
  import1 - 14,296 hosts (executed once every week)
  import2 - 3646 hosts (executed once every week)

1. We tried to fetch the records for the scans done in last week, the number has gone down to 32239.
2. Then we tried to fetch the number of hosts that were scanned, and the returned value is 17927.

On further checking it was seen that hosts are scanned twice on two consecutive days.
For example: scan date is 17th Feb, host belonging to one of the above imports was scanned again on 18th.
We have verified with client that at a time a host is part of only one import.
Could you confirm if this is a normal behavior?
What else can I check here?
Why is the host being scanned twice on 17th and 18th when the import is scheduled to run only once every week(17th Feb in this case)

The client is licensed for only 10K hosts, and they are running scans for more than that.
This is also generating additional records in the database, is there a way where we can limit SVM to scan only 10K hosts, and any additional scan should not be logged in database? I have verified host license for the client is set to 10K.

Is there a way to not log errors "license reached limit" in database, can we purge these?
If yes, which database/table should I be looking at to achieve this?

I would really appreciate if there is a link that I could refer to, to better understand how data is being stored in database.

Regards,

Aftab Ansari

[raslam]

Hello Aftab, 

We have answered your questions below. 

On further checking, it was seen that hosts are scanned twice on two consecutive days.
For example, the scan date is 17th Feb, host belonging to one of the above imports was scanned again on the 18th.
We have verified with a client that at a time a host is part of only one import.
Could you confirm if this is normal behavior?
What else can I check here?
Why is the host being scanned twice on 17th and 18th when the import is scheduled to run only once every week(17th Feb in this case)

Answer: It seems like the import schedule is still running. The important thing you need to check is the SVM daemon, like from which SVM account it was downloaded and installed? As you mentioned, they are using more licenses, so this could be they have multiple SVM accounts running the same SCCM import schedules and therefore using more licenses? If you manage to find that account,  then try to login to that account and set the daemon import schedule to weekly. 
https://docs.flexera.com/csi/Content/helplibrary/System_Center_Import_Schedules__Requires_the_Software_Vulnerability_Manager.htm#svm_cloud_edition_scanning_1104539063_1033723

The client is licensed for only 10K hosts, and they are running scans for more than that.
This is also generating additional records in the database, is there a way where we can limit SVM to scan only 10K hosts, and any additional scan should not be logged in database? I have verified host license for the client is set to 10K.

Answer: Yes, we can set the actual SVM account license count to 10 k. Maybe the account they are using is the admin account created by a root SVM account. We need to change the license count for the SVM root account. 

Is there a way to not log errors "license reached limit" in database, can we purge these?
If yes, which database/table should I be looking at to achieve this?

Answer: We cant purge these messages since any new scans coming into SVM with no licenses available will show these messages. But we usually advise our customer to run the database cleanup rule from time to time to delete the old data. For example, remove the machines which haven't been scanned for 2 weeks. This will free a lot of licenses and any new machine reporting in will not show these messages. 
https://docs.flexera.com/csi/Content/helplibrary/Database_Cleanup.htm?Highlight=database%20cleanup

At this point, the customer can follow the below steps. 

Run the cleanup rule to delete the unnecessary data from the DB. 
Find an account from which the SVM daemon was installed and then delete the existing schedules.
Login to the accounts which they want to use for SCCM import and install the daemons with the same accounts.
Create a weekly schedule on those SVM accounts. 

This will simplify their data and then will get fewer data into their tool.  We hope this clarifies. If you need further help then we kindly advise you to create a ticket via your Flexera Support Community portal and one of the SVM Support engineers will get back to you. 

Regards,

Raheel