Overview

You look at files in explorer and see several corrupted file types. You noticed that running a previous month's report resulted in missing data for half the month. No database rotation is in use. There are a high number of events (e.g., hundreds of millions) in the database.

Solution

1. Starting a new database is one possible way to resolve the issue. Please follow the instructions here: Creating a New Database in GFI EventsManager
2. To delete the old corrupted database, remove all files and folders that start with the name of the database. C:\Program Files (x86)\GFI\Database Server 2.1\DatabasesThe name of the DB can be checked under Configuration > Options > File Storage.

The caveat is that these steps will not recover the old corrupted data prior to the new database creation. 

You may want to set up Database Rotation to prevent the database from growing too large, a common factor in database corruption cases.  To set up database rotation, please follow this article: Setting a Database Rotation and Retention Policy 

Use settings similar to the following depending on your requirements:

• Check Enable database rotation

• Check Rotate the database on the 1st of each 1 month

• Set Number of databases to create (level 0 for no limit) to 13

These settings will store 1 year's worth of data, and EventsManager will automatically create a new database for each month, preventing each one from becoming too large. You can still switch to the old databases if you need to run a report against the data for a prior month. See the screenshot showing these settings below:

​

These settings may be preferable as you can control the length of time data is kept as needed if you have specific auditing requirements by changing the value for the number of databases to create.

Splitting the databases by calendar month is also convenient as you know which database(s) to run a report against depending on the timeframe needed rather than having to work out when the rotations occurred.