Option to limit log retention up to 1 Year

Aleem

So I saw an option to retain the logs up to 100000 however the requirement is to save / retain the logs up to a year for audit requirements so is there a feature to retain logs based on time?

kellytice

No there isn't a setting (not even a hidden one) to set the retention to X days of data in the Logs/Data store.

Retention is really a function of the space allocated to the Logs/Data store. SEM will basically fill up that space with the 'normalized' (parsed) log data until it hits 90% full. From the point that it hits 90%, it will try to maintain that 90% by rolling out the oldest log events to make room for the newest.

So, it isn't exactly what you were looking, but you could give SEM less space if you want to cut down on the number of logs retained, but as you can probably guess that is a much less precise approach since the amount of log data coming in may vary wildly from day to day (so it wouldn't always have the same # of days' worth of data).

- - - -
As a side note, you may see references to these commands that can be run from the SEM cmc console window, and they may sound like what you are looking for, but be aware that these are referring to the thresholds for the RAW log data (the events that are temporarily stored in the syslog store - not the logs/data store that has the 'normalized' log Events that you were hoping to affect):

• setlogrotate = how often to roll the current syslog file.
• limitsyslog = how many rolled files to keep before older ones are deleted.