anuragmal

Delete older event logs

Discussion created by anuragmal on Oct 19, 2012
Latest reply on Oct 26, 2012 by RSA Admin

Hi , We am using an ES setup and have a 2 DAS connected to the RSA. We store events in one of the DAS and backup the same events on another. Perform scheduled daily backup for the same (lsmaint). Now we want to delete older events (say -6M) from RSA , but would like to retain the backup for the same. Checked the command ' -delete ' , it deletes all the events from even backup location. So can you suggest how to delete older events from Collector without deleting it from backup.

Checked the command "lsmaint -show -gmt -time start -6M >check.txt" it shows that it is looking for all the files, even from backup so if i perfrom delete action it would delete the same too.

 

Cheers

Anurag

Outcomes