Too many files inside a quarantine folder - accumulated packages / traces (4218207)

• Active folder has accumulated files
• Quarantine folder has accumulated files

Active folder has accumulated files

ApexSQL Audit is designed to be fault tolerant and handle situations which can interrupt auditing, such as network failures, server outages and more. During such scenarios, audit files will be stored in the configured temporary folder(s) on both central and audited servers.
Once the issue is resolved, data processing will continue.

Quarantine folder has accumulated files

Moreover, when there are problems with processing SQL session files, ApexSQL Audit will periodically try to reprocess them. If for any reason, a file cannot be successfully processed and audited data cannot be inserted into the central repository database these files will be stored in a quarantine folder.

Depending on resolution time and audit activity, accumulated data can grow to large volumes.

Depending on the scenario, follow these general troubleshooting guidelines:

Active folder has accumulated files - Central Server

1. Check if ApexSQL.Audit.Processor.Central is running:
   
2. If it is running, end task. The process should re-start right away. Test if this step solved the issue, else proceed to step 3.
3. Open services.msc:
   
4. Check if ApexSQL server side components host service (SSC) is running and using Local System account for Log On:
   
5. Stop SSC service.
6. In task manager, end task for ApexSQL.Audit.Processor.Central.
7. In services.msc, start SSC service. Test if the issue is resolved, else proceed to step 8.
8. Confirm ApexSQL Requirements and Permissions are met.
9. Open a service request.

Active folder has accumulated files - Audited Server

1. Check if ApexSQL.Audit.Processor.Distributed is running:
   
2. If it is running, end task. The process should re-start right away. Test if this step solved the issue, else proceed to step 3.
3. Open services.msc:
   
4. Check if ApexSQL server side components host service (SSC) is running and using Local System account for Log On:
   
5. Stop SSC service.
6. In task manager, end task for ApexSQL.Audit.Processor.Distributed.
7. In services.msc, start SSC service. Test if the issue is resolved, else proceed to step 8.
8. Confirm ApexSQL Requirements and Permissions are met.
9. Open a service request.

Quarantine folder has accumulated files

Once a file is moved to the quarantine folder, it will remain there pending manual intervention.

Step#1. Move files back to the active folder to attempt re-processing. The active folder depends on the audit technology configured. More details here.

• ActiveSessions – for the session files from the Extended Events data collection method
• ActiveSQLAudits – for the session files from the SQL Audit data collection method
• ActiveTraces – for the session files from the Trace data collection method
• Packages/ReceivedPackages – for the filtered files ready for database insert

Step#2. Check if the files process or return to the quarantine folder. If the files return to the quarantine folder they can be submitted for analysis.

Note: When large file quantities accumulate, OS and iops limitations could cause processing to significantly slow down. It is recommended to move files in batches that will not overload your system (e.g. 100 files at a time).