I've been told that if my Log Decoder hasn't enough space on its packetdb volume, the data won't be available for investigation as well, and will be rolled over as new data comes in.
So, if the Log decoder stores all the raw logs for the purpose of investigation, then I understand that it has to be allocated 1.9TB worth of disk space.
30G 29G 1.8G 95% /var/netwitness/logdecoder/sessiondb
114G 107G 7.1G 94% /var/netwitness/logdecoder/metadb
64G 15G 50G 23% /var/netwitness/logcollector
1.9T 1.8T 111G 95% /var/netwitness/logdecoder/packetdb
What I'm unclear about is the purpose of allocating 1.8 TB to the metadb volume on the Concetrator. What exactly is stored within?
180G 171G 9.2G 95% /var/netwitness/concentrator/sessiondb
84G 20G 65G 24% /var/netwitness/concentrator/index
1.8T 1.7T 101G 95% /var/netwitness/concentrator/metadb
Also, which volume is responsible for the availability of data on the investigation console? Is it the packetdb volume on the Log Decoder or the metadb volume on the Concentrator? As per the meta.oldest.file.time value is concerned, it seems like the value for this key found on the Concentrator is the indicator of console availability.