Highlighted
Absent Member.
Absent Member.
627 views

How to determine the oldest event stored in Logger ?

Hi,

Do you know how could I determine the oldest event (its timestamp) stored in "Default Storage Group" ? The Logger is recycling the storage group and I need to know the oldest available data. A scheduled daily report would be awesome!

Thank you,

Dragos.

Labels (1)
Tags (2)
0 Likes
Reply
3 Replies
Highlighted
Absent Member.
Absent Member.

Re: How to determine the oldest event stored in Logger ?

I'm interested in this information as well.  Seems like it would be rather important to know if your storage group is no longer meeting the defined retention policy.

0 Likes
Reply
Absent Member.
Absent Member.

Re: How to determine the oldest event stored in Logger ?

Same here I would love a way to tell what the oldest event in logger is!

It would also be nice to know how much storage each device product is using.

0 Likes
Reply
Highlighted
Micro Focus Expert
Micro Focus Expert

Re: How to determine the oldest event stored in Logger ?

Here is a query for the earliest event. Select a particular storage group at runtime.

Try this, and select the storage group you are interested in at runtime.

SELECT
min(events.arc_deviceReceiptTime) as "Earliest Event",
events.arc_deviceVendor as "Vendor",
events.arc_deviceProduct as "Product",
events.arc_name as "Event Name"

from events

WHERE
Events.arc_deviceVendor <> 'ArcSight' AND
events.arc_eventId IS NOT NULL

The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.