Configure Core Dump Retention

[#1]

When a NetWitness service starts, it checks the cores directory for core files. If any are older than 90 days, they are deleted. Then, if the core files take up more than 500 GB, the service will delete them from the oldest until the core files are under this limit.

A new feature is added to all NetWitness services allowing the user to customize the time and size limits using new configuration parameters under the /sys/config node in the Explore view.

This picture shows the new parameters in the explore screen on a decoder. To update, simply click the value and enter a new value as you would with any other configuration parameter. The new values will take effect the next time the service starts.

Parameters

• Core Dump Maximum Age

• Core Dump Maximum Size

Core Dump Maximum Age

This parameter controls the maximum number of days that the service will keep core files. Any core file older than the number shown here (in days) will be deleted when the service starts. The default is 90. The values range from 10 to 1825 (5 years)

Core Dump Maximum Size

This parameter controls the maximum number of bytes that core files can take on the disk. When the service starts, if the total of all core files is over this limit, the service will start deleting files starting with the oldest, until the total amount of disk space used is under this limit. The default is 500 GB, and the range is 10 GB -1000000000 GB. "0" is allowed and means unlimited.

As the core files are kept on the same drive as the meta DB. As such, the value for Core Dump Max Size should be coordinated with the meta DB space limitations and the physical storage size.