SCA Import Stuck at 70%

Usage and Config Security
1

We recently had an issue with running imports and SCA has been unable to run a successful report for the last 19 days. About 36 hours ago we fixed the problem that was stopping the imports, however, the import has been running for approximately 36 hours and is stuck on 70%. I could not find any technical data on SCA imports so I’m not sure if its trying to import 19 days worth of data or just 1 day. Any thoughts would be appreciated.

Should we cancel the the import and restart, should we give it another day, should we reconfigure SQL to take less memory, etc?

2

It is in fact importing the last 19 days worth of data, but it shouldn’t make it take that long unless you have a rather large deployment.

Which step is it stuck on? Can you post the current import log?

3

Log is attached, I’m not sure what step it is stuck on, the last successful step was the SCM::ExceptionMembership stage

Start Time: 2014-12-02 02:26:24 UTC
Status: Import 70% complete
Duration: 40:56:40

  Import Log:
  # Logfile created on 2014-12-02 02:26:24 +0000 by logger.rb/v1.2.7

2014-12-02 02:26:24 (+0:00:00.000) INFO: TEMA version: 1.5.78
2014-12-02 02:26:28 (+0:00:03.596) INFO: Calling Model.before_snapshot: Success
2014-12-02 02:26:36 (+0:00:08.773) INFO: Initialize datasource Datasource: Success
2014-12-02 02:26:37 (+0:00:00.379) INFO: ETL from Datasource - DatasourceSite (0x000000002E1418B3 - 0x0000000030437C53): Success
2014-12-02 02:26:43 (+0:00:06.500) INFO: ETL from Datasource - RawDatasourceAnalysisActivation (0x000000002E1418B3 - 0x0000000030437C53): Success
2014-12-02 02:27:04 (+0:00:21.012) INFO: ETL from Datasource - RawDatasourceAnalysis (0x000000002E1418B3 - 0x0000000030437C53): Success
2014-12-02 02:27:13 (+0:00:08.694) INFO: ETL from Datasource - DatasourceAnalysis (0x000000002E1418B3 - 0x0000000030437C53): Success
2014-12-02 02:27:46 (+0:00:32.595) INFO: ETL from Datasource - DatasourceProperty (0x000000002E1418B3 - 0x0000000030437C53): Success
2014-12-02 02:27:56 (+0:00:10.688) INFO: ETL from Datasource - RawComputerId (0x000000002E1418B3 - 0x0000000030437C53): Success
2014-12-02 02:28:16 (+0:00:19.552) INFO: ETL from Datasource - Computer (0x000000002E1418B3 - 0x0000000030437C53): Success
2014-12-02 02:28:38 (+0:00:21.939) INFO: ETL from Datasource - ComputerPropertyValue (0x000000002E1418B3 - 0x0000000030437C53): Success
2014-12-02 02:28:44 (+0:00:06.005) INFO: ETL from Datasource - ComputerDimension (0x000000002E1418B3 - 0x0000000030437C53): Success
2014-12-02 02:30:56 (+0:02:12.159) INFO: ETL from Datasource - RawDatasourceFixlet (0x000000002E1418B3 - 0x0000000030437C53): Success
2014-12-02 02:35:51 (+0:04:54.664) INFO: ETL from Datasource - DatasourceFixlet (0x000000002E1418B3 - 0x0000000030437C53): Success
2014-12-02 02:36:28 (+0:00:37.375) INFO: ETL from Datasource - DatasourceGroupFixletResult (0x000000002E1418B3 - 0x0000000030437C53): Success
2014-12-02 02:36:56 (+0:00:27.637) INFO: ETL from Datasource - DatasourceGroup (0x000000002E1418B3 - 0x0000000030437C53): Success
2014-12-02 02:37:01 (+0:00:05.118) INFO: ETL from Datasource - RawDatasourceGroupMembership (0x000000002E1418B3 - 0x0000000030437C53): Success
2014-12-02 02:38:04 (+0:01:03.356) INFO: ETL from Datasource - DatasourceGroupMembership (0x000000002E1418B3 - 0x0000000030437C53): Success
2014-12-02 02:38:20 (+0:00:16.303) INFO: ETL from Datasource - SCM::Sentinel (0x000000002E1418B3 - 0x0000000030437C53): Success
2014-12-02 02:40:10 (+0:01:49.928) INFO: ETL from Datasource - SCM::Checklist (0x000000002E1418B3 - 0x0000000030437C53): Success
2014-12-02 02:44:38 (+0:04:27.592) INFO: ETL from Datasource - SCM::Check (0x000000002E1418B3 - 0x0000000030437C53): Success
2014-12-02 02:44:38 (+0:00:00.117) INFO: ETL from Datasource - SCM::CheckProperty (0x00000000304339CE - 0x0000000030437C53): Success
2014-12-02 02:45:10 (+0:00:31.764) INFO: ETL from Datasource - SCM::CheckPropertyValue (0x000000002E1418B3 - 0x0000000030437C53): Success
2014-12-02 02:45:12 (+0:00:02.593) INFO: ETL from Datasource - SCM::CheckDimension (0x000000002E1418B3 - 0x0000000030437C53): Success
2014-12-02 02:45:32 (+0:00:19.957) INFO: ETL from Datasource - SCM::DesiredValue (0x000000002E1418B3 - 0x0000000030437C53): Success
2014-12-02 02:46:05 (+0:00:32.559) INFO: ETL from Datasource - SCM::MeasuredProperty (0x000000002E1418B3 - 0x0000000030437C53): Success
2014-12-02 02:46:23 (+0:00:18.267) INFO: ETL from Datasource - SCM::CheckMeasuredProperty (0x000000002E1418B3 - 0x0000000030437C53): Success
2014-12-02 02:47:46 (+0:01:22.570) INFO: ETL from Datasource - SCM::MeasuredPropertyValue (0x000000002E1418B3 - 0x0000000030437C53): Success
2014-12-02 03:43:25 (+0:55:39.112) INFO: ETL from Datasource - RawDatasourceFixletResult (0x000000002E1418B3 - 0x0000000030437C53): Success
2014-12-02 03:45:17 (+0:01:51.673) INFO: ETL from Datasource - RawDatasourceSiteSubscription (0x000000002E1418B3 - 0x0000000030437C53): Success
2014-12-02 03:56:41 (+0:11:24.527) INFO: ETL from Datasource - DatasourceSiteSubscription (0x000000002E1418B3 - 0x0000000030437C53): Success
2014-12-02 04:05:04 (+0:08:23.091) INFO: ETL from Datasource - SCM::Vulnerability (0x000000002E1418B3 - 0x0000000030437C53): Success
2014-12-02 04:22:31 (+0:17:27.075) INFO: ETL from Datasource - SCM::VulnerabilityResult (0x000000002E1418B3 - 0x0000000030437C53): Success
2014-12-02 04:22:49 (+0:00:17.799) INFO: ETL from Datasource - SCM::ComputerEvaluationStatus (0x000000002E1418B3 - 0x0000000030437C53): Success
2014-12-02 04:23:09 (+0:00:19.600) INFO: ETL from ComputerGroupMembership : Success
2014-12-02 04:24:48 (+0:01:39.654) INFO: ETL from SCM::ExceptionMembership : Success

4

Seems like you’re stuck on CheckResult, which is probably one of the longer-running steps.

Unfortunately Vincent is out right now, and he’d have a better idea of what expected performance should be. I’ll check in with him when I see him.

Can you provide information about the size/nature of your deployment? How long have previous imports taken?

5

Thanks, previous imports usually take anywhere from 1 to 3 hours. We have about 15,000 end points. Do you happen to know if SCA is trying to import just one day’s worth of results or is it trying to import multiple days at once?

6

It will be importing all missing data, so yes multiple days worth. Even considering that this seems strange. I would suspect either a problem with limited resources, or that something has happened to the SCA process. Looking at the server logs might shed some light.

7

Okay, I’m thinking that if it is trying to load 19 days worth of data and given that it normally takes 1 to 3 hours for daily imports then it may take 3 days to complete an import. The import log doesn’t show any errors and the tema.log doesn’t show any error’s that look abnormal. Ther mail_error.log doesn’t show anything abnormal either.