000034518 - How to set the archiver data retention to run at a custom time in RSA Security Analytics 10.6

Document created by RSA Customer Support Employee on Dec 29, 2016•Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 2Show Document
  • Comment • 0
  • View in full screen mode

Article Content

Article Number000034518
Applies ToRSA Product Set: Security Analytics, NetWitness Logs and Packets
RSA Product/Service Type: Archiver
RSA Version/Condition: 10.6.x
 
IssueFor RSA Security Analytics 10.6 and above, the Data Retention tab under Administration -> Services -> Archiver -> Config and only allows users to set the Duration and not the time at which the retention rule is set to be run.
ResolutionTo achieve this, follow the steps below.
 

  1. Navigate to Administration -> Services -> Archiver -> Explore.
  2. Expand sys -> config.
  3. Right-click on scheduler and select Properties.
  4. In the drop down, select addMil and paste the following in the Parameters field:
    pathname=/archiver/collections/default/database time=12:00:00 daysOfWeek=all msg=timeRoll params="type=meta,packet,session days=365"

This will run the retention scheduler at 12:00:00 everyday and roll over all entries older than 365 days.

Attachments

    Outcomes