Host GS: Data Retention Scheduler Tab

Document created by RSA Information Design and Development on Mar 21, 2017
Version 1Show Document
  • View in full screen mode
  

This topic describes the configurable options in the Data Retention Scheduler tab for Decoder, Log Decoder, and Concentrator.

In the Data Retention Scheduler tab, you can define the criteria for removing database records from primary storage on Decoder, Log Decoder, and Concentrator services, and schedule the timing for checking the threshold. 

For information on the Data Retention tab for Archiver, see the Data Retention Tab - Archiver topic in the Archiver Configuration Guide.

Note: If additional customization is necessary, it can be done using the Scheduler under the Files tab in the Services Config view. For example, if more storage is available to save the RAW data versus the meta, it may make more sense to use Capacity as the threshold and to set different thresholds per database (meta versus packet).

To access the Data Retention Scheduler tab: 

  1. In the Security Analytics menu, select Administration > Services.
  2. Select a Decoder, Log Decoder, or Concentrator, and then select Actions menu cropped > View > Config.
  3. In the Services Config view for the service, click the Data Retention Scheduler tab.

The following figure illustrates the parameters in the Data Retention Scheduler tab for a Decoder.

DRtabDec.png

Features

The Data Retention Scheduler tab has sections to specify Threshold settings and Run settings. The following table lists the parameters supported for data retention configuration.

                           
ParameterDescription
ThresholdThe threshold is based on the age of the data, the amount of time the data has been stored or the date on which the data was stored. The date is from the database file, not from the actual session time.
  • Duration: The duration of time that data can be stored before removal. Specifies the number of days (365 maximum), hours (24 maximum), and minutes (60 maximum) that have elapsed since the time stamp on the data.
  • Date: The removal of data based on the date of the timestamp. Specifies the monthly date and time in the Calendar and Time fields.
RunThe schedule for running the job that checks rollover criteria.
  • Interval: Schedule the database check to occur at a regular interval. Specifies the Hours and Minutes between the scheduled checks.
  • Date and Time: Schedule the database check to occur at a regular day and time. Specifies the day from the drop-down list and the system clock time in hh:mm:ss format. Possible values for day are Everyday, Weekdays, Weekends, and Custom, where Custom allows you to select one or more specific days of the week.
ApplyOverwrites any previous schedule for this service and applies the new settings immediately. 

Caution: Once these settings have been applied and the threshold is met, the old data will be deleted from the database and no longer accessible.

ResetResets the schedule to the last applied state.
Next Topic:Files Tab
You are here
Table of Contents > References > Services Config View > Data Retention Scheduler Tab

Attachments

    Outcomes