This topic describes the parameters in the Data Retention Scheduler tab.
In the Data Retention Scheduler tab, you can define the criteria for removing database records from primary storage on Decoder, Log Decoder, Concentrator, and Archiver services, and schedule the timing for checking the threshold. For Archiver, records move from primary hot storage to warm storage, then to cold storage.
Note: If additional customization is necessary, it can be done using the Scheduler under the Files tab in the Services Config view. For example, if more storage is available to save the RAW data versus the meta, it may make more sense to use Capacity as the threshold and to set different thresholds per database (meta versus packet).
To access the Data Retention Scheduler tab:
- In the Security Analytics menu, select Administration > Services.
- In the Services grid, select one of the services that store data and > View > Config.
- In the Services Config view for the service, click the Data Retention Scheduler tab.
The following figure illustrates the parameters in the Data Retention Scheduler tab for an Archiver.
The Data Retention Scheduler tab has sections to specify Threshold settings and Run settings. The following table lists the parameters supported for data retention configuration.
The threshold is based on the age of the data, the amount of time the data has been stored or the date on which the data was stored. The date is from the database file, not from the actual session time.
The schedule for running the job that checks rollover criteria.
Overwrites any previous schedule for this service and applies the new settings immediately.
Caution: Once these settings have been applied and the threshold is met, the old data will be deleted from the database and no longer accessible.
|Reset||Resets the schedule to the last applied state.|