Outstanding Contributor.. rtoni1 Outstanding Contributor..
Outstanding Contributor..
298 views

New Logger (6.7) archive age functionality

Hi all,

 

Logger 6.7 apparently now has the ability to age out older archives.  Couple questions:

- will the Logger automatically purge any old archives from the remote share as soon as I change / reduce this setting?  Or will this happen on the next archive scheduled run?  For example, if I have a year's worth of archives and I set the age to 30 days, will it remove anything older than 30 days?  Is this captured as an internal / audit event?  

- will similar functionality be available on ESM at some point?

 

Thanks

7 Replies
Micro Focus Expert
Micro Focus Expert

Re: New Logger (6.7) archive age functionality

Hi,

 

Nice question, I raise this feature sometime back, I will need to check this out, and will let you know how its been implemented. If it is configured like the retention on the storage group, and I guess it might be (because of where it is configured), and if it behaves the same as the storage group retention, then it should trigger as soon as the change is made to the retention.

You could confirm this by tailing the logger_server.log, you should see something like [retentiontrigger] or something in the logs and how much it is removing.

if you get a chance to test that, before I get back to you, I would appreciate if you could update here also.

Thanks!

Lar

0 Likes
Outstanding Contributor.. rtoni1 Outstanding Contributor..
Outstanding Contributor..

Re: New Logger (6.7) archive age functionality

Thanks Lar,

I set the archive retention to 30 days for internal events on one of the loggers, and just looked at the archive share, there are now only 30 days worth of archives there - so it appears that the purging occurs immediately.

I think this is a really useful feature, would also like to see it on ESM - any idea if that is on the roadmap?

 

0 Likes
Super Contributor.. Carl_E Super Contributor..
Super Contributor..

Re: New Logger (6.7) archive age functionality

Nice feature indeed but not a full implementation.

They dropped the feature in Logger but didn't add archive age to the ArcMC policy.  So you end up having to visit each Logger to define this.

I opened a feature request for this - ARCMC-15226

<rant>

Customers shouldn't have to ask for this...  MF should have the vision to deliver a full implementation.

MF needs to stop allowing changes to be implemented in Logger without making the same change in ArcMC.  They also need to test how changes to Logger impact ArcMC. 

Another bug I encountered after upgrading Logger and ArcMC to the latest version was a new restriction to the characters allowed in the description field of Logger roles.  ArcMC wasn't tested (or was poorly tested) regarding this Logger change and I was no longer able to push users from ArcMC to my Loggers.  The only error ArcMC provided was "500 Internal Error".

</rant>

Highlighted
Outstanding Contributor.. rtoni1 Outstanding Contributor..
Outstanding Contributor..

Re: New Logger (6.7) archive age functionality

Thanks @Carl_E - +1 on the sentiments.

Not to open a can of worms here but I also need to rant just a bit.  Your points about "not a full implementation" and "poorly tested" extend way beyond just this feature. 

I have been fighting with ArcMC since migrating @3 years ago, and sometimes it is actually less effort to just visit the manged nodes and do the work there piecemeal, than it is to work around the annoyances, issues, bugs, unpredictability of ArcMC. 

out of politeness the original rant somewhat redacted (after a bite to eat and some fresh air) - but I stand by the overall frustration with the evolution of this product.

I have worked with some great support people at HP / MicroFocus over the years, and that's saved my sanity, but even they scratched their heads sometimes over the state of ArcMC.  

 

Super Contributor.. Carl_E Super Contributor..
Super Contributor..

Re: New Logger (6.7) archive age functionality

Ranting on a Friday AND on an empty stomach is asking for trouble. 😉

Lots of great HP/HPE/MF folks have worked on Arcsight over the years, seeing this thread just made think that this was still Protect724 and it called for me to add to the conversation.

Wishing you a good weekend @rtoni1 

0 Likes
Outstanding Contributor.. rtoni1 Outstanding Contributor..
Outstanding Contributor..

Re: New Logger (6.7) archive age functionality

@Carl_E thanks for the chuckle.  You're correct on all points  - hence the retraction after posting.  Some days it's easy to vent, forgetting that the hardworking folks in the trenches get caught in the crossfire. 

 

Have a great weekend as well...

 

 


0 Likes
Valued Contributor.. Heiha9 Valued Contributor..
Valued Contributor..

Re: New Logger (6.7) archive age functionality

Fully agree. We also submitted a case for that feature -- which should really be obvious.

To add: there is bug ARCMC-15260 open for the group descriptions and supposed to be fixed in ArcMC 2.9.2.
0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.