System Activity Log - Thousands of "Log on" Rows

We have System Activity Log enabled. It was filled with almost a million records, so I purged old records.
But, I see that certain users generate dozens and dozens of “Log in” records in this ice.SysActivityLog table throughout the day. For example, I opened Epicor this morning, opened System Activity Log, and saw 85 Log in" messages created in a few seconds like this:

I created a case for Tech Support, and after some back and forth with a ‘senior engineer’, I got this response, “None of the data provided would lead Support to conclude that these records are a cause for concern.” Well, that answer does not exactly instill confidence that these records are expected and normal.

So, does anyone else have the System Activities checkbox checked in Company Maintenance, and have multiple Log in records? Should I just take the advice of Support and ignore it?

Running 10.2.700.29 fully on-premises.

Are you multi-company or multi-site? You may be getting a new login record if people are switching companies or sites.

Do you use SSO?

We are single company, single site.
We do not use SSO.

Does the System Agent show recurring tasks?

I do NOT have track system activity checked and STILL get tons of these rows. Support insists logons are tracked whether you check that box or not. So I don’t understand the point of the checkbox. I am unable to purge ours because there are too many records (55 million+). Support insists my only option is to use the system activity purge program which of course will not work on that volume of data. Because I can’t prove that the records are currently causing any specific issue support is unwilling to offer any other solution.

Mark,
Do you mean scheduled tasks in System Monitor? Only 2

And System Monitor mostly shows no Active Tasks unless someone prints a report.
The Ice.SysTask table currently has 5 rows, all reports with COMPLETED status.

1 Like

Can you turn System Activity Logging off? (Company Maintenance)

Company Maintenance-General Settings Fields

System Activities

Select this check box to track the system activities occurred within the application such as changes to the Company record, logon failures, user logins and logouts.

These activities can then be reviewed within an activity log. You display this information by launching the System Activity Log Tracker; access this tracker from the Main Menu by opening the System Management > Security folder.

Yes, I can turn off System Activity Logging, and unlike @aosemwengie1, it does in fact stop all logging to the table.

Or I can leave Logging on and just ignore all the entries, then purge them after another few years when they grow towards a million records again.

But before I do either one of those options, I would like to know that these entries are not indicating something wrong with our Epicor system. Does all the time spent logging on mean our performance is not what it could be?

Which user is ATL? If its an integration process it could be establishing a new session every few seconds. It tells you who the user is, what account is ATL?

@aosemwengie1 - We had the same issue (90M records, 30GB!). On case CS0002362125, Epicor provided a one line SQL script to truncate the table. Use at your own risk!

TRUNCATE TABLE Ice.SysActivityLog
1 Like

I know, I want support to tell me its ok to do that. So far they are insisting its not acceptable and I have to use the purge program.

image

They never will, updating Epicor via SQL is directly against their support agreement.

1 Like

Yup! I was reluctant too. Have them reference my case… Or worst case, insist on uploading your database, and let them see first hand that the purge app will crash eventually with that many records. Escalate the case, and you should get someone more senior that has done this fix before.

1 Like

That has not been my experience, I’ve been provided direct sql statements to run more than once.

Yeah I haven’t given up yet.

For what its worth all that program does is call DeleteByID on each item one at a time

Which then uses the back end Service
image

Which literally finds the row in the table SysActivityLog by AcitivitySeq

Then calls the “Base” OnDeleteByID which takes the current row and deletes it form the given table.

Which just creates a transaction and calls DeleteRow

Which uses the Db Context and calls DeleteObject (passing in the current row)

Which is a remarkably long way to do TRUNCATE TABLE . As far as I can tell Epicor doesn’t do any other dependency checking or has any FK Constraints on that table.

5 Likes

User ATL is my own account. I have system security privileges, but otherwise I’m just a user. All integration system processes use a “manager” user account. It seems some user accounts generate lots of these login messages and others do not.

There are only those 85 login message in a row when I start up the Epicor client. Once loaded, the messages stop until I open a new screen or enter data in an existing screen. Then, there are usually batches of 3 log in messages in a row anytime any user enters data into a screen. Like this:

Oh, and here’s my one line SQL script to purge the records (use at your own risk):

Delete from ice.SysActivityLog Where ActivitySeq < 20100000