Web protection reporting database jobs

Administrator Help | Forcepoint Web Security and Forcepoint URL Filtering | v8.5.x

The following database jobs are installed along with the Log Database.


	Important If you are using a full version of Microsoft SQL Server (not Express), the SQL Server Agent service must be running on the database engine machine. Make sure that this service is configured to start automatically when SQL Server or the machine is restarted.

The Extract, Transform, and Load (ETL) job runs continuously, receiving data from Log Server, processing it, and then inserting it into the standard logging partition database. When trend data retention is enabled, the ETL job is also responsible for inserting trend data into the catalog database.

The ETL job must be running to process log records into the Log Database.

The database maintenance job performs database maintenance tasks and preserves optimal performance. This job runs nightly, by default.

Once data is processed and moved to the database tables used by the Cloud Apps report, the maintenance job is also responsible for deleting cloud apps data that is more than 2 days old from temporary log database tables.

The Internet browse time (IBT) job analyzes the data received and calculates browse time for each client. The IBT database job is resource intensive, affecting most database resources. This job runs nightly, by default.

When trend data retention is enabled, the trend job uses daily trend data created by the ETL job to update weekly, monthly, and yearly trend records for use in presentation reports.

Even when trend data retention is disabled, the trend job processes data from the threats (AMT) partition to provide trend data on the Threats dashboard.

This job runs nightly.

The Advanced Malware Threat (AMT) ETL job receives, processes, and inserts data into the threats partition database. Only log records that include a severity ranking (see How severity is assigned to suspicious activity) are recorded in the threats partition. Data from this partition is used to populate the Threats dashboard (see Threats dashboard).

The AMT ETL job also populates the database tables used to provide the data for all application reports and the Advanced File Analysis report.

Certain aspects of these database jobs can be configured on the Settings > Reporting > Log Database page. See Log Database administration settings for more information.

When configuring the start time for the maintenance job and the Internet browse time job, consider system resources and network traffic. These jobs are resource intensive, and can slow logging and reporting performance. When trend data retention is enabled, the trend job is run, by default, at 4:30 a.m. Try to avoid starting other jobs at times that might overlap with the trend job.