Big news! The community will be moving to a new platform April 21. Read more.
Big news! The community will be moving to a new platform April 21. Read more.
Absent Member.. Absent Member..
Absent Member..
1974 views

How can I reduce space by deleting some information in an ArcSight logger ?

Jump to solution

I have a problem my ArcSight logger is running out of space how can I reduce some data on the:

94% /DefaultStorageGroup

94% /InternalEventStorageGroup

94% /LongRetention

94% /ShortRetention

I would like to delete data that is older than 5 years ???

Thanks for the anwser

Regards

Miha



Labels (1)
0 Likes
22 Replies
Absent Member.. Absent Member..
Absent Member..

I have the Storage Group maximum size:

NameMaximum Age (Days)Maximum Size (GB)CreatorLast Editor
Default Storage Group18015adminadminEdit
Internal Event Storage Group3655SystemSystemEdit
Long Retention 11830185adminadminEdit
Long Retention 23655adminadminEdit
Short Retention 13655adminadminEdit
Short Retention 2305adminadminEdit

But if I change it I will probably loose ArcSight event data ?

0 Likes
Commodore
Commodore

When increasing the size I have not lost data the times I have done it.

0 Likes
Absent Member.. Absent Member..
Absent Member..

If I calculate my maximum size I get 225 GB. That is probably the size of ArcSight mySQL ?

If I reduce the maximum size wheal the ArcSight database be also reduced ?

Thanks for the answer

Miha

0 Likes
Micro Focus Expert
Micro Focus Expert

Look for *.hprof files. These can be deleted to recover space, sometimes these files are large.

0 Likes
Absent Member.. Absent Member..
Absent Member..

Tanks for the info. unfortunately those files on my ArcSight are only a couple of kilobytes in size.

0 Likes
Absent Member.. Absent Member..
Absent Member..

If I quote Judson:

When increasing the size I have not lost data the times I have done it.

The problem is I would like to decrease the size of the Storage Group. This will probably shrink ArcSight database and eventually delete some data.


Thanks for the answer

Miha

0 Likes
Absent Member.
Absent Member.

You should enable archiving. Logger will archive all data to an external server and you will be able to reactivate it later. Retention time for archive data will be defined by the archiving server.

There is a price for that: searching across archiving data is significantly slower in comparison to online data since indices are gone (may be changed at Logger 6 though).

View solution in original post

0 Likes
Absent Member.
Absent Member.

See my post about events archives.

0 Likes
Absent Member.. Absent Member..
Absent Member..

Sounds promising. Where can I enable Archiving in ArcSight Logger?

Can you specify the time interval from where on you won to Archive ?

0 Likes
Absent Member.
Absent Member.

Logger 6.0 Admin Guide

Page 286: "Event Archives"

You will need to establish NFS/SAN/CIFS mount first, then configure events archiving.

0 Likes
Absent Member.. Absent Member..
Absent Member..

Thank you this info will help me alot.

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.