akash1609 Valued Contributor.
Valued Contributor.
320 views

Logger storage query

HI Experts,

I am implementing new logger 6.4, in storage part i have below querys. So pls clarify.

1. How storage group is diffrentiating particular logs retention period, becasue in storage group we are not giving any devices or receivers details.

2.Event archive is must ? 

3. Event archive means log backup ?

 

Thanks,

Akash

 

Thanks, Akash.
0 Likes
1 Reply
Highlighted
ABader Super Contributor.
Super Contributor.

Re: Logger storage query

Hi Akash,

>1. How storage group is diffrentiating particular logs retention period, becasue in storage group we are not giving any devices or receivers details.

You have to create Device Groups for your differnent Devices that send the events to Logger.

Based on the Device Groups you must create Storage Rule.

if you have no storage Rule all Logs are storage in default Storage Group. (No separation)

The internal Arcsight Events of logger are stored in internal Storage Group.

 

>2.Event archive is must ? 

yes, if your logger crashes you must have archives to setup logger with old data again.

And you can extend the Data you save if you use online Storage and offline archive Storage togther.

Don't forget to save a daily Config backup.

otherwise you can't reload the archives later.

>3. Event archive means log backup ?

yes, all Logs that the Logger gets and all internal events are backuped into archive.

You can decide which storage Group you want to archive

it's all documentated here:

https://community.softwaregrp.com/t5/Logger/Installation-Guide-for-Logger-6-4/ta-p/1587589

https://community.softwaregrp.com/t5/Logger/Administrator-s-Guide-for-Logger-6-4/ta-p/1596211

 

Kind regards.

Andreas.

 

.

The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.