checkmk #knowledgebase

Problems with sqlite and the mk event History

Since Checkmk 2.4 the History of Checkmk Eventconsole is written to a sqlite file. The Problem is, as bigger these files get, the bigger will be the overhead to udpate them. In a big, Event Based Environment this lead to an crash. Here are workarround to solve that

Export the Date

First of all how to export the History in a csv file.
For that you need sqlte3 installed.

Enter the ~/var/mkeventd

There you find the history.sqlite. No Problem if the file has just some MB. but in the Problem Setup it had 22 GB.

Use the following commands to export the files zu csv:

>>sqlite3 history.sqlite
sqlite> .headers on
sqlite> .mode csv
sqlite> .output history.csv
sqlite> SELECT * FROM history;
sqlite> .quit

Logroate

If you want to start with an clean history every month, you can rotate this file. Just note, that you are not able to browse the history in the GUI after the rotatin, but you can always Export the csv if you need to find something.

/omd/sites/cmk/var/mkeventd/history/history.sqlite {
   rotate 16
   monthly
   nocompress
   dateext
   prerotate
       omd stop mkeventd
   endscript
   postrotate
       rm -f /omd/sites/cmk/var/mkeventd/history/history.sqlite
       omd start mkeventd
   endscript
}

Dont forget to adjust the path in the first line and then Place this as a file in ~/etc/logrotate.d