We are using Arcsight Express. Our event log archive size (daily) was between 2 and 4 gigabytes. When the disk is full i move the files to another location. However last couple of weeks our event archive size increased to 10 - 13 gigabytes. This is a very big size and since arcsight's event log archive disk size is 200 gb it is getting full nearly 20 days.
A couple of weeks ago i added new connectors and our eps increased, i think this is the reason. How can i reduce the size of the event log archives?
Thanks in advance.