LEM log retention inquiry

Hello,

Can someone help me get information on how I can check what my current log retention period is on solarwinds lem? From the Explore tab/nDepth, I am unable to see information dating back 1 year ago. I need to find the settings for the log retention and try and set it for the system to store logs for at least 2 years before rewriting over it. Are these settings within the LEM dashboard or is it within the virtual appliance, if so, where?

Please assist,

Francois Fannoh

Find more posts tagged with

retention

retention_policy

solarwinds event

log_retention

solarwind lem service

log event

virtual appliance

Accepted answers

All comments

valkos

There are no log retention settings (yet).

By default, once the log DB reaches 90%, the older logs get overwritten.

So depending on the amount of logs you're receiving on LEM, it could be anywhere from few weeks to over a year.

I believe LEM could improve the retention capabilities, by having some sort of categorization inside the Policy settings area.

I know we can select whether we want to keep them in log DB or not, but an additional setting to allow for log prioritization.retention could be useful.

E.g. the Threat events to be retained forever, while events with low value (system noise) could be set to be cleared in xx amount of time

jrouviere

As Valkos states, there's no way to hard code log retention in the LEM at the moment. Instead it's based on how much HDD space you have. You can use the Database Maintenance Report to tell how much data you're storing (and calculated in Days):

Success Center

To increase retention you need to allocate additional HDD space:

Success Center