InTrust Indexing reporting size limit warning and errors (4244225)

InTrust Indexing reporting size limit warning and errors in the InTrust Application log that may concern adminsitrators. These events include:

Log Name:      InTrust
Source:        InTrust Indexing
Event ID:      13875
Task Category: Repository Services
Level:         Warning
Keywords:      Classic
Computer:      InTrustServer.mydomain.com
Description:
The indexing queue of long-term events in repository "Default InTrust Audit Repository" is about to grow to an unmanageable size. If it keeps growing at the same rate, searching in the repository and import from it can slow down considerably. Please check the InTrust Server event log for errors, and consider collecting less audit data to this repository and adding more indexing servers.

Log Name:      InTrust
Source:        InTrust Indexing
Event ID:      13904
Task Category: Repository Services
Level:         Error
Keywords:      Classic
Computer:      InTrustServer.mydomain.com
Description:
The number of unmerged files in repository "Default InTrust Audit Repository" exceeded the size limit.

Log Name:      InTrust
Source:        InTrust Indexing
Event ID:      13877
Task Category: Repository Services
Level:         Warning
Keywords:      Classic
Computer:      InTrustServer.mydomain.com
Description:
The indexing queue of recent events in repository "Default InTrust Audit Repository" exceeded the size limit. Please check the InTrust Server event log for errors, and consider collecting less audit data to this repository and adding more indexing servers.

The 'about to grow to an unmanageable size' warnings are a notification that the indexing queue is is close to being exceeded. Meaning that the logs are gathering close to a rate that exceeds the Indexing Services ability to index the repository.

The 'exceeded the size limit' errors and warnings indicate the Indexing queue is exceeded and number of events gathered exceeds the ability of the InTrust server to index the events.

Gathering is not impacted by the warnings and errors but viewing and searching events may not function correctly.

1. Consider adding an Intrust server for dedicated Indexing to improve indexing performance.
2. Consider adjusting the Data merging frequency from the current default of every 24 hours to every 12 hours.
   1. This is an organization parameter named 'IDX_GenerateNewSegmentPeriod' for and by default merges the indexing every 1440 minutes. This value  could be reduced to 720 minutes.
   2. The Organization Parameters are accessible in InTrust manager by right clicking on the InTrust Manager and selecting Properties. Select the Parameters tab and place a check mark in the Show all box in the  lower left hand corner. Locate the parameter 'IDX_GenerateNewSegmentPeriod' and select Edit to modify the value.
   3. After making this change, restart the InTrust Server services.

3. Reduce the frequency of the Gathering Tasks.