Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

App Control: Why is the cache.db-wal file very large?

App Control: Why is the cache.db-wal file very large?

Environment

  • App Control Agent: All Versions
  • Linux: All Supported Versions

Symptoms

It is observed that on a Linux endpoint, the cache.db-wal file may be quite larger than the cache.db file itself.

Cause

This is expected behavior.

Resolution

The WAL file is a temporary file used by SQLite and is automatically removed when the last connection to the database closes. When an Agent is installed and in a healthy state, this only happens when either:

Additional Notes

This file is a rollback journal for an SQLite database, similar to a transaction log on Microsoft SQL. In the SQLite documentation db-wal files are defined: 
A write-ahead log or WAL file is used in place of a rollback journal when SQLite is operating in WAL mode. As with the rollback journal, the purpose of the WAL file is to implement atomic commit and rollback. 
The WAL file is always located in the same directory as the database file and has the same name as the database file except with the 4 characters "-wal" appended. 
The WAL file is created when the first connection to the database is opened and is normally removed when the last connection to the database closes. 
However, if the last connection does not shut down cleanly, the WAL file will remain in the filesystem and will be automatically cleaned up the next time the database is opened.

 

Related Content


Labels (1)
Was this article helpful? Yes No
0% helpful (0/1)
Article Information
Author:
Creation Date:
‎12-07-2018
Views:
3687
Contributors