Log Data retention and Archiving

Question

Hi

With regard to data retension we need the following

6 months data is available to be reported on as requested, but 12 months data is held in total

We have recent installation LEM 5.3.1, but require more clarification on the following:

1) Can the 50 day clear up of syslog data be extended or the raw data archived off.

2) We have extended our VM disk size to 500GB, will the server expend into this space (diskusage shows log/data total 230GB)

3) If none of the above what would be the best approach to maintain a total log storage of 12 months.

Thanks

Mark Van-Kerro

phil3 · Accepted Answer

Hi, Mark.

I think these two KBs will help:

How many days of live data will the LEM database store?

How to Configure Backups on Your LEM Appliance

With regard to your extended VM disk, the appliance will use whatever it can whenever it needs it. I think with the backups in place, you'll definitely be able to meet your retention targets, and with the extended disk size, you should be able to meet your 6-month requirement for accessible data.

If you find you still need to extend the frequency at which the appliance rotates the original syslog data, contact Support and they will be able to discuss your options in more detail.

Thanks.