2016-05-20
03:09 AM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
How to delete few session id
How to delete few session id from concentrator and broker ? We have around 15 days data on concentrator ? We want to delete some session id on concentrator so that it will not visible on concentrator.
- Tags:
- Community Thread
- Discussion
- Forum Thread
- NetWitness
- NW
- NWP
- purging
- RSA NetWitness
- RSA NetWitness Platform
1 Reply
2016-11-03
10:38 AM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
I don't believe there is any way to selectively delete specific session IDs from the Concentrator. If the retention on the Concentrator is too low (15 days), then you should look at the combination of the options below:
1. Truncate Decoder ingest that may not be necessary for investigations
2. Set keys on Decoder to transient or only index at IndexKeys (or IndexNone) for keys that are not relevant to investigations.
3. Add more storage / DACs
