Welcome Serena Central users! CLICK HERE
The migration of the Serena Central community is currently underway. Be sure to read THIS MESSAGE to get your new login set up to access your account.
jones Absent Member.
Absent Member.
654 views

Hi , we are new to ArcSight tool , Could any one clarify the difference between Default storage group and Internal event storage group and funtions of these two storage groups

Jump to solution

Hi ,  we are new to ArcSight tool , Could any one clarify the difference between Default storage group and Internal event storage group and funtions of these two storage groups

Labels (1)
0 Likes
1 Solution

Accepted Solutions
Outstanding Contributor.. andrew.dalbor Outstanding Contributor..
Outstanding Contributor..

Re: Hi , we are new to ArcSight tool , Could any one clarify the difference between Default storage group and Internal event storage group and funtions of these two storage groups

Jump to solution

Hi Jones,

Storage groups are what ArcSight use to group events from a storage perspective.  You can create different storage groups with different retention policies to better architect your storage and archival solutions.

The internal event storage group is usually reserved for system events pertaining to ArcSight itself.

The default storage group as the name states is the default group configured on first install.  It is usually where all of the event data from your different sources are stored.

Storage groups can also help your refine your searches by specifying which group to search in thus speeding it up.

View solution in original post

0 Likes
5 Replies
Outstanding Contributor.. andrew.dalbor Outstanding Contributor..
Outstanding Contributor..

Re: Hi , we are new to ArcSight tool , Could any one clarify the difference between Default storage group and Internal event storage group and funtions of these two storage groups

Jump to solution

Hi Jones,

Storage groups are what ArcSight use to group events from a storage perspective.  You can create different storage groups with different retention policies to better architect your storage and archival solutions.

The internal event storage group is usually reserved for system events pertaining to ArcSight itself.

The default storage group as the name states is the default group configured on first install.  It is usually where all of the event data from your different sources are stored.

Storage groups can also help your refine your searches by specifying which group to search in thus speeding it up.

View solution in original post

0 Likes
jones Absent Member.
Absent Member.

Re: Hi , we are new to ArcSight tool , Could any one clarify the difference between Default storage group and Internal event storage group and funtions of these two storage groups

Jump to solution

Hi Andrew,

Thank you for the clarification , and one more point in mind is , if we are taking archive to mount location , is the data copied to mount location or it will moved to mount location by deleting in logger storage .

Regards,

Jones


0 Likes
stefan.oancea Outstanding Contributor.
Outstanding Contributor.

Re: Hi , we are new to ArcSight tool , Could any one clarify the difference between Default storage group and Internal event storage group and funtions of these two storage groups

Jump to solution

Hello Jones,

If you change the default location of the archives (which is ~/logger/data/archives/) to a new location where for example you mounted an external larger storage space, then all subsequent new archives will be automatically written directly to that new location - you need to change the "Archive Location" from ArcSight Command Center -> Administration -> Storage and Archive and here edit the desired Storage Group. The old archives however (the ones already created in the past) will remain in the old location by default, so they will not be automatically moved to the new one.

In order to be able to use the entire new mounted storage space for archiving (which I assume will be larger) be sure to also change the logger.archive.space.allocated-in-gb option in the /opt/arcsight/logger/current/arcsight/logger/user/logger/logger.properties file.

You can find some more information on this topic here: https://protect724.hp.com/message/53903#53903

Best regards,

Stefan

0 Likes
sujansures Absent Member.
Absent Member.

Re: Hi , we are new to ArcSight tool , Could any one clarify the difference between Default storage group and Internal event storage group and funtions of these two storage groups

Jump to solution

Hi ​,

To make it straight and simple, the Internal Storage Group is for ArcSight and the Default Storage Group is for events coming from end devices to the ArcSight.

Regards,

0 Likes
Micro Focus Expert
Micro Focus Expert

Re: Hi ,  we are new to ArcSight tool , Could any one clarify the difference between Default storage group and Internal event storage group and funtions of these two storage groups

Jump to solution

Hi Jones,

The data is not removed from the storage group until the retention policy kicks in and removes it.

Best regards,

Lar

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.