AnsweredAssumed Answered

Investigation data not available for more than 10 days

Question asked by Visham Rawat on Jul 30, 2019
Latest reply on Aug 2, 2019 by Visham Rawat

I've been told that if my Log Decoder hasn't enough space on its packetdb volume, the data won't be available for investigation as well, and will be rolled over as new data comes in.


So, if the Log decoder stores all the raw logs for the purpose of investigation, then I understand that it has to be allocated 1.9TB worth of disk space.

                       30G   29G  1.8G  95% /var/netwitness/logdecoder/sessiondb
                      114G  107G  7.1G  94% /var/netwitness/logdecoder/metadb
                       64G   15G   50G  23% /var/netwitness/logcollector
                      1.9T  1.8T  111G  95% /var/netwitness/logdecoder/packetdb


What I'm unclear about is the purpose of allocating 1.8 TB to the metadb volume on the Concetrator. What exactly is stored within?

                      180G  171G  9.2G  95% /var/netwitness/concentrator/sessiondb
                       84G   20G   65G  24% /var/netwitness/concentrator/index
                      1.8T  1.7T  101G  95% /var/netwitness/concentrator/metadb


Also, which volume is responsible for the availability of data on the investigation console? Is it the packetdb volume on the Log Decoder or the metadb volume on the Concentrator? As per the meta.oldest.file.time value is concerned, it seems like the value for this key found on the Concentrator is the indicator of console availability.  

Please clarify.