How to configure logs retention?

[PedroQueiros]

Hello all,

I'm trying to understand retention periods (in this case, using Virtual Machines) and I need your help.

In the "Admin -> Services -> Log Decoder / Concentrator" config, I see the tab "Data Retention Scheduler", where I'm not imposing any threshold, and I have the scheduler run every 15 minutes.

AFAIK, this should not limit the amount of meta/raw data the VMs save, being only dependent on the size of the partitions we have in the VMs.

Right now, as per the license monitoring, we're using 5GB/day of logs. I have a 250GB root partition on the Concentrator (25% used) and a 650GB root partition on the Decoder (17% used).

Today I tested, and I can only go back 10 days using the concentrator - is this normal? How can I increase this?

Thank you for your help!

Kind Regards,

Pedro Queirós

[PedroQueiros · Accepted solution]

For your information, we had not configured correctly the size of the partitions in the RSA NW configuration (Services -> Explore -> Database -> Config), and this was the culprit.

We believe it's fixed now.