Article Number
000034518
Applies To
RSA Product Set: Security Analytics, NetWitness Logs and Packets
RSA Product/Service Type: Archiver
RSA Version/Condition: 10.6.x
Issue
For RSA Security Analytics 10.6 and above, the Data Retention tab under Administration -> Services -> Archiver -> Config and only allows users to set the Duration and not the time at which the retention rule is set to be run.
Resolution
To achieve this, follow the steps below.
- Navigate to Administration -> Services -> Archiver -> Explore.
- Expand sys -> config.
- Right-click on scheduler and select Properties.
- In the drop down, select addMil and paste the following in the Parameters field:
pathname=/archiver/collections/default/database time=12:00:00 daysOfWeek=all msg=timeRoll params="type=meta,packet,session days=365"
This will run the retention scheduler at 12:00:00 everyday and roll over all entries older than 365 days.