
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
arcsight express v4 corre engine archive storage full

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
Re: arcsight express v4 corre engine archive storage full
Best to move it, unless you know for sure that you don't need it.
If you want to delete it, then go to /opt/arcsight/logger/data/archives and delete the older archives (the folder names are date stamps)
If you really don't need archives, then you can also stop them from being created via the web front end. They are enabled by default.


- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
Re: arcsight express v4 corre engine archive storage full
In scheme work Express has restriction for size folder /opt/arcsight/logger/data/archives.
But in practice Express has free 1Tb in /opt folder. You may move archive folder from /opt/arcsight/logger/data/archives to /opt/backup/archives (for example) and archive storage clean up.


- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
Re: arcsight express v4 corre engine archive storage full
Hi Evgeny & all,
Do you know whether we can restore/load the archives from an appliance to another one (for example: do a RMA)? Thanks!


- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
Re: arcsight express v4 corre engine archive storage full
On usergroup i see, but restore archive may only with systemtable restore.
Earlier, i use comands for reload in DB all archives:
- cd /home/arcsight/logger/current/arcsight/logger/bin
- ./arcsight restorearchives -C clear