Currently my logger rentention is set as 90days
But the size accumulated is 7995GB / 8000GB
I do have a NAS and set as daily backup.
1) Will my data be missing?
2) Say currently daily live is about 350GB, as the space is limited how will Arcsight allocated the remaining space?
If the allocated size fills up before the end of the 90 day period, the oldest data will be dropped from the table. If you write a daily archive, you can always load the old data back in should you require it. The archives are completely separate from the allocated storage mentioned below.
Hope this helps.
' the oldest data will be dropped from the table'
am i right to say that, Logger will allocated the needed space, since i only left wil 5GB of space and i require 350GB, Logger will drop the old data (may consists of more than 1 day) till the space is needed?
It will drop in 1GB chunks for most people. The guide says:
The total space allocated for a storage group includes a certain amount that has been set aside to ensure that the group can receive new events when it is almost full. As a result, the percentage of used space for a storage group never reaches 100% (as displayed on the Monitor > Summary page). For Software Loggers installed using the Minimal setting, the maximum % Used (On the Monitor > Summary page) for each storage group reaches up to 66.33%. (Two storage groups of 3 GB each; 1 GB is set aside for new events in each group. After 2 GB of space has been used and the new events are being written to the last 1 GB, Logger automatically triggers retention and reclaims 1 GB of the used space. Thus, the % Used field for each storage group only reaches up to 66.33%.)