Administrators can define and order retention rules for log storage collections on an Archiver. Retention rules specify the type of logs to be stored in the collection. For your log collections to gather and store log data, you must associate them with at least one retention rule. When you configure a retention rule, you specify a condition and a collection for that rule. The condition (rule definition) determines the type of logs stored in that collection.
For the condition, you can use anything that works in a regular query where clause.
For example, to get logs from compliance services, you can use the following condition:
device.group='PCI Devices' || device.group='HIPPA Devices'
After you define the retention rules for your collections, it is important that you specify the order of your retention rules. NetWitness Platform evaluates the retention rules for all of the collections in numerical order by the number listed in the Order column in the Retention Rule section of the Data Retention tab of the Archiver ( (Admin) > Services Config view).
Before you configure your retention rules:
- Configure total hot, warm, and cold storage
- Configure log storage collections
Define a Retention Rule for a Collection
- Go to (Admin) > Services, click , and select Archiver.
The Services Config view of Archiver is displayed with General tab open.
The Rule Definition dialog is displayed.
Configure the fields in the Rule Definition dialog as described in the following table:
Field Description Rule Name Specify a unique name for your retention rule. It cannot include spaces. For example: LowValueWinLogs Condition
Specify the conditions for the type of logs that you want to include in the collection.
All string literals and time stamps must be quoted. Do not quote number values and IP addresses.
device.type='winevent_nic' && msg.id='security_4648_security'
Collection Select the collection on which you want to apply this rule. For example: LowValue.
The retention rule that you define becomes associated with the collection you selected. On the Data Retention tab, in the Collections section, you can click > Select Rules in the Actions column for the selected collection to view the retention rules associated with the collection in the Retention Rule section.
Specify the Order of your Retention Rules
To prioritize the complete list of all of your retention rules: