Overview

Users can maintain the Scan Results Database backend (the SQL Database used by LanGuard) in good shape to avoid database size issues or corruption, or slow status reporting from the scanned servers, by using the database maintenance options available in GFI LanGuard.

This article guides through the various settings available and maintenance recommendations, for example, regular backups and shrinking. These recommendations and settings can also be used to address the console warning "Less than 200 MB Left Until database Size limit reached".

Solution

GFI LanGuard console allows users to configure settings and perform maintenance operations on the security scan results backend database.

GFI LanGuard's backend database (named as LNSSScanResultsXX, where the XX corresponds to the version number) expects a minimum of 1 MB of data for a preset vulnerability scan per machine. This can vary greatly depending on the number of installed and missing patches, applications, etc.

Apart from Scan Results, the backend database also contains Computers, Computer Groups, Computer Overview, Computer and Computer Group Settings, Attributes, and other things that are configurable per computer such as ScanProfile Overrides, Agents, Relays, Data Sync. Refer to the GFI LanGuard Scan Results Database Structure for more information.

It is important to keep attention to the database settings since uncontrolled growth can lead to slow performance and unexpected issues.

Configuring Database Backend Settings

GFI LanGuard can work with either Microsoft SQL Server or Microsoft SQL Server Express as a database backend.

Note: Microsoft SQL Server Express edition is free but places limits on database size, usually 10 Gb. We recommend using Microsoft SQL Server Express for GFI LanGuard deployments managing up to 2,000 computers or devices. For larger deployments, use Microsoft SQL Server Standard Edition, which is not free but has an upper limit of 524 Petabytes.

 To change the configured backend database:

1. Launch GFI LanGuard.
2. Click Configuration tab > Database Maintenance Options > Database backend settings.

3. Select the MS SQL Server option and choose the SQL Server that will be hosting the database from the provided list of servers discovered on the network.

4. Specify the SQL Server credentials or select the Use Windows Authentication option to authenticate to the SQL server using windows account details.

5. Click OK to finalize the settings.

6. Click Yes to stop all current scans.

If the specified server and credentials are correct, GFI LanGuard automatically logs on to the SQL Server and creates the necessary database tables. If the database tables already exist, it reuses them.

Depending on the environment, it may be necessary to adjust the credentials in step 4. If the option Use Windows Authentication is chosen, the system will use the same credentials as the LanGuard services running. This should work fine as long as the end-user has given permissions to that account in SQL.

Alternatively, we generally suggest using the SQL SA credentials since no additional internal configuration is required for this to work. The SA account has all of the proper access needed to function correctly.

Back to the top

Managing Saved Scan results

Use the Saved Scan Results tab to maintain the database backend and delete saved scan results no longer required. This can be a quick temporary fix when the database hits the size limit.

1. Launch GFI LanGuard.
2. Click Configuration tab > Database Maintenance Options.
3. Select Manage Scan Results and delete old and unneeded scans.

Back to the top

Configuring Data Retention Settings

A more permanent solution is the automated removal of old scans results through scheduled database maintenance. During scheduled database maintenance, GFI LanGuard automatically deletes saved scan results older than a specific number of days/weeks or months.

It is also possible to configure automated database maintenance to retain only a specific number of recent scan results for every scan target and scan profile.

1. Launch GFI LanGuard.
2. Click Configuration tab > Database Maintenance Options > Database backend settings.
3. Select the Retention tab and set the needed retention policy.

If the retention settings are greyed out, it means that LanGuard is currently performing a scanning operation. Check again once it is completed.

All the options are self-explanatory.

GFI recommends the following settings:

• Scan results: 5 scans per target per profile or less.
• Scan history: 3 months or less, unless required for compliance purposes.

Scan history, as seen in the History tab or reports, is a listing of differences between the most recent scan being imported and the last scan of the same type.

Back to the top

Viewing and Removing Scanned Computers

GFI LanGuard maintains a global list of scanned computers for licensing purposes. Any computers in excess of what is specified in the licensing information are not scanned. This section allows systems administrators to delete scanned computers to release licenses that were previously utilized.

This process is described in Removing Scanned Computers to Free up Licensing in GFI LanGuard.

Back to the top

Tuning SQL Server Settings

Below are the recommendations for the SQL Server settings tuning:

• Exclude the data directory and the log directory from antivirus scanning.
• Put the database file and log files on different drives.
• Change the auto-growth settings to influence how much the database file and log files expand when growth is needed. If a bigger amount of data is added regularly, it is recommended to increase the auto-growth setting (database file increased in bigger amounts, but less frequently).
• If the database is using too much memory - restrict it from using all the memory.
• Make sure the SQL Server has access to all processors.
• Check the size of the log file periodically and keep it small by implementing one of the following:
  • Configure full backups on the database. This will shrink the log file to a few MB every time the backup runs.
  • Periodically run a shrink job on the database (or just the log file). A large transaction log can cause queries to be extremely slow.
• Monitor the performance with the help of Windows Performance Monitor. Pay attention to the disk activity at Performance Monitor > Disk > Storage > Drives > Active time. High disk activity means bad performance.

Configuring the data retention settings and tuning the SQL Server settings for the LNSSScanResults database can help to avoid some of the following potential problems:

• slow user interface
• agent scan taking a long time to begin
• remediation failing to consistently complete
• remediation pending completion for a long period of time
• slow reporting of the correct server status

Back to the top

Testing

Additional testing is required only when the backend database location or access settings were changed. Run a quick Manual Scan and verify that it completes without errors.

Back to the top