The Log Receiver Service uses .sdf files to store logs received from Defender Security Servers. For each Defender Security Server, the Log Receiver Service creates a separate .sdf file.
These .sdf files are called the Log Receiver Service database and contain data used by the Defender Management Portal to display authentication log-related data, including the authentication statistics provided on the Dashboard tab of the portal.
On the Defender Management Portal computer, you can find these .sdf files in the following folder:
%ProgramFiles%\One Identity\Defender\Management Portal\WWW\App_Data
The name of each .sdf file has the following format: <DSS name>.<domain>.sdf
<DSS name> is the name of the corresponding Defender Security Server.
<domain> is the name of the Active Directory domain where the corresponding Defender Security Server resides.
In the event that the Management Portal activity is not being updated, you can try the following procedures to correct this issue.
Restart the Log Receiver service.
1. Stop the Log Receiver service.
2. Navigate to the App_Data folder under the Defender Program Files folder (C:\Program Files\One Identity\Defender\Management Portal\WWW\App_Data).
3. Rename the dss.server.com.SDF files and the Events.SDF file to .sdf.old.
4. Restart the Log Receiver service and new files should be generated.
5. Wait for DSS activity and see if Dashboard is populated again.
If it is working again, you can delete the old SDF files.
If you need further assistance, please contact Support.