So I saw an option to retain the logs up to 100000 however the requirement is to save / retain the logs up to a year for audit requirements so is there a feature to retain logs based on time?
No there isn't a setting (not even a hidden one) to set the retention to X days of data in the Logs/Data store. Retention is really a function of the space allocated to the Logs/Data store. SEM will basically fill up that space with the 'normalized' (parsed) log data until it hits 90% full. From the point that it hits 90%, it will try to maintain that 90% by rolling out the oldest log events to make room for the newest. So, it isn't exactly what you were looking, but you could give SEM less space if you want to cut down on the number of logs retained, but as you can probably guess that is a much less precise approach since the amount of log data coming in may vary wildly from day to day (so it wouldn't always have the same # of days' worth of data). - - - - As a side note, you may see references to these commands that can be run from the SEM cmc console window, and they may sound like what you are looking for, but be aware that these are referring to the thresholds for the RAW log data (the events that are temporarily stored in the syslog store - not the logs/data store that has the 'normalized' log Events that you were hoping to affect):
setlogrotate
limitsyslog
Interested in the same.
Cisco Firepower Threat Defense FTD-1.3.6.1.4.1.9.1.2320.ConfigMgmt-CommandsExported with NCM 2023.4.2
AlertSummary.xmlHi All, I've done some work to tidy up our alert definitions (both the Alert Manager and Alert Actions) and the more important alerts have now been tailored and given a "[ *** ]" prefix so it is easy to see the alerts we have catered for versus those that might appear once in a while. I am monitoring this…
I wanted to share a new dashboard a co-worker ( @mblackburn ) came up with to help us better view groups of interfaces and various metrics for each. Using a single HTML widget, we are able to visually compare numerous different interfaces by populating each interface dataset onto its own graph. We are able to view…
PALO-ALG - Logging.xmlPalo Alto Networks ALG Security Technical Implementation Guide :: Version 2, Release: 3 Benchmark Date: 27 Oct 2022
