Excalibur.db file Size

Hi flomb 

The Excalibur.db file is required for threat analysis. This is used in both Intercept X and root cause analysis in the central administration portal. The Excalibur.db is a SQL Lite database for Hitman Pro.

Originally, the file would periodically run cleanup to remove the oldest entries in the file so that it would not grow in size at such a fast rate, however, in some cases, this does not occur. You can stop the "HitmanPro.Alert" service then rename/delete/backup excalibur.db & when you restart the services it will be re-created.

Also, a reboot should also help you with your issue. The file should be automatically recreated much smaller. 

Thanks, this helped me as I had a server where the file was in excess of 40GB which I have now cleared as per your instructions.

Can you please advise what a 'normal' size range for this file should be.

I intend to add this file to our monitoring solution to alert if the file becomes excessive. On most of our servers the file is between 50MB and 100MB. Would it be reasonable to set an alert threshold of 1GB for this file, or are there times when the file may be genuinely this large?

I think there are some registry keys to control the trimming of the database. I.e. how often it runs the clean-up, how much to retain and how much to trim on each parse.  They can be set under: HKLM\Software\HitmanPro.Alert

There are 3 REG_SZ values:

• ExcaliburCleanupPollPeriod - Value in seconds, representing the period of time that should elapse between each attempt to clean up. Default is equivalent of 10 minutes.
  
  
• ExcaliburDefaultCutOff - Value in seconds, representing age before which any record is deleted. Default is seconds equivalent of 90 days (so roughly 3 months).
  
  
• ExcaliburCleanupRowLimit - V3.8.0+, the number of rows that will be deleted on each pass. 0 represents "delete all matching rows" (unlimited).

Maybe something to be aware of.

You can't stop the hitmanpro.alert service

Hi Stuart James

You can restart the service as mentioned after performing the above steps. 

What are you talking about? There are no steps above.

Shweta said:

You can stop the "HitmanPro.Alert" service then rename/delete/backup excalibur.db & when you restart the services it will be re-created.

If I can't stop the service, how am I meant to delete the excalibur.db file which is in use by the service?

Hi Stuart James

Is the tamper protection disabled? 

Ahuh. That allowed me to stop it. Thankyou.

Hi Stuart James

You're welcome. Please reach out to us if you have any further concerns.