This topic provides information on how to define the criteria for removing data from primary storage, and to schedule the timing for checking the threshold. For Archiver, records move from primary storage to warm storage, and from warm storage to cold storage.
On the Archiver, you need schedule the rollover of data for primary (hot) storage to secondary (warm) storage, and finally to permanent (cold) storage. There are two parts to the configuration.
- The rollover criteria define a threshold for rolling data over to the next storage tier. The rollover criteria apply to the meta, session, log, and packet databases. You can rollover data from the primary data storage to the secondary storage if you have configured a secondary storage, otherwise, the rolled over data is moved to cold storage. Data in the primary and secondary storage is available for queries and reports in Security Analytics. Data in cold storage is not available for queries and reports, and can be restored if needed.
- The schedule defines the interval for checking if rollover criteria has been reached. At each interval, the Security Analytics runs a process to check if the data is ready for rollover, and if ready performs the rollover.
Refer to Configure Data Retention in the Data Privacy guide for more detailed information.