3 of 3 people found this helpful
For ExternalEvent nodes the ProviderAccess is under the ExternalEvent; there is no DiscoveryRun and hence is removed a the same time as the ExternalEvent.
Then there is something I don't understand. Considering this:
- the pattern triggered on the event create 2 IntegrationResult node (running 2 SQL queries)
- One invocation per day, 28 days removal delay
In this case, We should have 56 IntegrationResults in the system, not more ?
Now if i run the following queries:
search ExternalEvent where __source = 'SID_Integration'
=> return 28 objects, it's ok
search ExternalEvent where __source = 'SID_Integration' traverse List:List:Member:ProviderAccess traverse DiscoveryAccess:DiscoveryAccessResult:DiscoveryResult:IntegrationResult
=> Returns 54 objects, ok maybe consolidation is not ended at the time I ran the query, not a big deal.
Now making it the other way around:
search IntegrationResult where label matches 'SIDQueries'
=> returns 842 objects (no deletion since the beginning)
search IntegrationResult where label matches 'SIDQueries' traverse DiscoveryResult:DiscoveryAccessResult:DiscoveryAccess:ProviderAccess traverse Member:List:List:ExternalEvent
=> Returns 27 objects, which is perfectly logic based on the first number above.
So for me it means that events has been removed, but not the associated IntegrationResult.
These queries has been executed on consolidator, but the event is sent on scanner. However we have the same kind of numbers in scanner, except for the third query returning 405 objects (still very big compared to what I expect)
Can you please highlight what could be wrong here ?
2 of 2 people found this helpful
I have been through the code and it is not doing the correct thing - raised defect DRUD1-25113
Perfect thank you !