2 Replies Latest reply on Apr 24, 2019 7:20 AM by jrouviere

    LEM log retention inquiry

    ffannoh

      Hello,

       

      Can someone help me get information on how I can check what my current log retention period is on solarwinds lem? From the Explore tab/nDepth, I am unable to see information dating back 1 year ago. I need to find the settings for the log retention and try and set it for the system to store logs for at least 2 years before rewriting over it. Are these settings within the LEM dashboard or is it within the virtual appliance, if so, where?

       

      Please assist,

       

      Francois Fannoh

        • Re: LEM log retention inquiry
          valkos

          There are no log retention settings (yet).

           

          By default, once the log DB reaches 90%, the older logs get overwritten.

          So depending on the amount of logs you're receiving on LEM, it could be anywhere from few weeks to over a year.

           

          I believe LEM could improve the retention capabilities, by having some sort of categorization inside the Policy settings area.

          I know we can select whether we want to keep them in log DB or not, but an additional setting to allow for log prioritization.retention could be useful.

           

          E.g. the Threat events to be retained forever, while events with low value (system noise) could be set to be cleared in xx amount of time

          • Re: LEM log retention inquiry
            jrouviere

            As Valkos states, there's no way to hard code log retention in the LEM at the moment. Instead it's based on how much HDD space you have. You can use the Database Maintenance Report to tell how much data you're storing (and calculated in Days):

             

            Success Center

             

            To increase retention you need to allocate additional HDD space:

             

            Success Center