Hey all, Im not a postgre or linux master but I found something. Based on this article: https://docs.splunk.com/Documentation/Phantom/4.10.7/Install/UpgradeOffline I notice how to run vacuumdb in phantom Centos 7 environment. In the article there is a line, I know that this arcitle is for old version 4 but give me some ideas how to run vacuumdb. To improve database performance, after completing the upgrade, run: su - postgres -c '/usr/pgsql-11/bin/vacuumdb -h /tmp --all --analyze-in-stages' After that there is the similar command but from phenv. /<PHANTOM_HOME>/bin/phenv /<PHANTOM_HOME>/usr/postgresql/bin/vacuumdb -h /tmp --all --analyze-in-stages Based on this i understand that --analyze-in-stages - only show statistics. After that I open folder: cd /opt/phantom/usr/postgresql/bin/ Next: phenv vacuumdb -h /tmp --all --analyze-in-stages But this command shows me only stats. But from this article I notice that vacuumdb command has parameter -full https://stackoverflow.com/questions/51204561/postgres-vacuum-doesnt-free-up-space Lets check vacuumdb documentation: https://www.postgresql.org/docs/current/app-vacuumdb.html --analyze-in-stages Only calculate statistics for use by the optimizer (no vacuum), like --analyze-only. Run three stages of analyze; the first stage uses the lowest possible statistics target (see default_statistics_target) to produce usable statistics faster, and subsequent stages build the full statistics. This option is only useful to analyze a database that currently has no statistics or has wholly incorrect ones, such as if it is newly populated from a restored dump or by pg_upgrade. Be aware that running with this option in a database with existing statistics may cause the query optimizer choices to become transiently worse due to the low statistics targets of the early stages. --all Vacuum all databases. --full Perform “full” vacuuming. So for general what was done to remove containers and reduce db disc space in Splunk SOAR 5.2: 1. cd /opt/phantom/bin/ 2. phenv python /opt/phantom/bin/delete_containers.pyc --label test --before "2020-01-01T12:00:00Z" 3. cd /opt/phantom/usr/postgresql/bin/ 4. phenv vacuumdb -h /tmp --all --full This reduce a space in my case. ! Warning!, Im not sure if this method is proper, but it works in my case. You can test it on your test environment and confirm if it works for you also. Maybe someone from Splunk Suport will be able to confirm this solution. General summary: phenv vacuumdb -h /tmp --all This command - "The standard form of VACUUM removes dead row versions in tables and indexes and marks the space available for future reuse. However, it will not return the space to the operating system," But this command: phenv vacuumdb -h /tmp --all --full Although VACUUM FULL can be used to shrink a table back to its minimum size and return the disk space to the operating system, there is not much point in this if the table will just grow again in the future. Thus, moderately-frequent standard VACUUM runs are a better approach than infrequent VACUUM FULL runs for maintaining heavily-updated tables. I hope it helps.
... View more
