RAW Logs Purging From Archvier based on specific device type , IP

[YogeshMavani]

How i can purge raw logs from archvier for the specific devices only ? Here want to purge only raw events not meta.

[Anonymous]

Hi Yogesh,

You can configure this from archiver >config > data retention > 

Please see the below document for the same

https://community.rsa.com/docs/DOC-80152 

Regards,

Linkan

[david_waugh]

Hi that woud work for configuring retention going forward, but i think the question is more about data that has already been ingested into the archiver.

Is it possible to selectively delete old sessions based on some criteria?

[Anonymous]

I don't know the exact answer, but NwConsole can do that. Take a look at the appropriate user guide:

11.1 - https://community.rsa.com/docs/DOC-86964 

11.2 - NwConsole User Guide for Version 11.2 

[david_waugh]

Hi Sean, I had a look but couldnt find it in the guide. If you can add any more pointers that would be great.