16.5 Re-Indexing in the Offline Mode

You can also use a tool to re-index event data partition, in the offline mode. The tool uses minimal number of resources without affecting any of the existing processes. Re-indexing operation in the offline mode takes longer when compared to reindexing by using the online mode.

You can run the tool outside the Sentinel server. However, you must copy the Java files and the Sentinel libraries folder to the machine from which you want to run the re-indexing tool.

Before you proceed, ensure that you have the following information:

  • The path to the folder where Java 1.8 is located. For default Sentinel installation, the path is: <sentinel_installation_path>/opt/novell/sentinel/jre/bin/java.

  • The path to folder where Sentinel 8.3.1.0 libraries are present. For default Sentinel installation, the path is: <sentinel_installation_path>/opt/novell/sentinel/lib.

  • The location of event data partitions. For default Sentinel installation, the path is:

    <sentinel_installation_path>/var/opt/novell/sentinel/data/eventdata/events/ for primary partitions.

16.5.1 Using the Offline Tool On the Sentinel Server

To use the offline tool from the Sentinel Server:

  1. Log in to the Sentinel server.

  2. Run the following command:

    <sentinel_installation_path>/opt/
novell/sentinel/jdk/bin/java -cp /opt/novell/sentinel/lib/ccsapp- 
<sentinel_version>-RELEASE.jar
esecurity.ccs.comp.event.indexedlog.IndexedLogRebuild -forcerebuild 
<partition-directory>/
<partition_ID>

    where, <sentinel_version> refers to the release version of Sentinel. For example, Sentinel 8.3.1.

    forcerebuild is an optional parameter. If this option is not specified, the tool creates a backup of index folder and temporary files, which occupies additional disk-space.

    <partition-directory> refers to the path where all the partitions are present.

    <partition_ID> refers to the ID of the partition in the following format:

    0200428_6E1CCA35-4BD4-102D-91CD-000C2907C76D or 20200428_6E1CCA35-4BD4-102D-91CD-000C2907C76D_20200607.

    If there are more than one partition, specify the IDs separated by space. You can also use the wild cards for ID such as, 202004*.

    For example, to re-index a single event data partition, specify the following command:

    <sentinel_installation_path>/opt/
novell/sentinel/jdk/bin/java -cp /opt/novell/sentinel/lib/ccsapp-
<sentinel_version>-RELEASE.jar 
esecurity.ccs.comp.event.indexedlog.IndexedLogRebuild -forcerebuild /
var/opt/novell/sentinel/data/eventdata/events/20200428_6E1CCA35-4BD4-
102D-91CD-000C2907C76D

    To re-index multiple event data partitions for April 2020, specify the following command:

    <sentinel_installation_path>/opt/
novell/sentinel/jdk/bin/java -cp /opt/novell/sentinel/lib/ccsapp-
<sentinel_version>-RELEASE.jar 
esecurity.ccs.comp.event.indexedlog.IndexedLogRebuild -forcerebuild /
var/opt/novell/sentinel/data/eventdata/events/202004*

  3. Restore the re-indexed partitions. For information about restoring data, see Restoring Data.

    NOTE:The event data partitions must be placed in either the primary or secondary storage paths for Sentinel.

16.5.2 Using the Re-Indexing Tool On a Separate Machine

To use the offline tool from a separate machine:

  1. Log in to the system.

  2. Copy the Java files from the Sentinel server to the machine from where you want to start re-indexing.

    For default Sentinel installation, the Java 1.8 path is: <sentinel_installation_path>/opt/novell/sentinel/jre/bin/java.

  3. Copy the Sentinel libraries from the Sentinel installation location to the machine from where you want to start re-indexing.

    For default Sentinel installation, the Sentinel library path is: <sentinel_installation_path>/opt/novell/sentinel/lib.

  4. Run the following command:

    <sentinel_installation_path>/opt/novell/sentinel/jdk/bin/
java -cp /opt/novell/sentinel/lib/ccsapp- 
<sentinel_version>-RELEASE.jar
esecurity.ccs.comp.event.indexedlog.IndexedLogRebuild 
-forcerebuild <partition_directory>
/<partition_ID>

    where, <sentinel_version> refers to the release version of Sentinel. For example, Sentinel 8.3.1.

    forcerebuild is an optional parameter. If this option is not specified, the tool creates a backup of index folder and temporary files, which occupies additional disk-space.

    <partition_directory> refers to the path where all the partitions are present.

    <partition_ID> refers to the ID of the partition in the following format:

    0200428_6E1CCA35-4BD4-102D-91CD-000C2907C76D or 20200428_6E1CCA35-4BD4-102D-91CD-000C2907C76D_20200607.

    If there are more than one partition, specify the IDs separated by space. You can also use wild cards for ID such as, 202004*.

    For example, to re-index a single event data partition, specify the following command:

    /opt/novell/sentinel/jdk/bin/java -cp /opt/novell/sentinel/lib/
ccsapp-<sentinel_version>-RELEASE.jar 
esecurity.ccs.comp.event.indexedlog.IndexedLogRebuild -forcerebuild /
var/opt/novell/sentinel/data/eventdata/events/20200428_6E1CCA35-4BD4-
102D-91CD-000C2907C76D

    To re-index multiple event data partitions for April 2020, specify the following command:

    /opt/novell/sentinel/jdk/bin/java -cp /opt/novell/sentinel/
lib/ccsapp-<sentinel_version>-RELEASE.jar 
esecurity.ccs.comp.event.indexedlog.IndexedLogRebuild -forcerebuild /
var/opt/novell/sentinel/data/eventdata/events/202004*

  5. Restore the re-indexed partitions. For information about restoring data, see Restoring Data.

    NOTE:The event data partitions must be placed in either the primary or secondary storage paths for Sentinel.