SSIM Data purging

Article:TECH193973  |  Created: 2012-07-29  |  Updated: 2012-07-31  |  Article URL http://www.symantec.com/docs/TECH193973
Article Type
Technical Solution

Product(s)

Issue



You need to purge SSIM  Data


Solution



SSIM Data purging
 
Purging incident or event summary data
 
On the Information Manager, you can select and purge event, incidents, tickets, and alerts based on the status or on the data type. You also have the option to purge all the data associated with the incidents and event summary. The Information Manager server restarts automatically after all of the selected data is purged. You must ensure to back up the database before purging data.
 
To purge selected incident or event summary data:
 
1. Log on to the Web configuration interface with Administrator credentials.
2. Click Maintenance -> Backup and Restore -> Purge.
3. From the options, select Purge Incident or Event Summary Data.
4. From the Purge view, check the data type items that you want to purge:
 
Hourly (or Short Term) Event Summary Data - Lets you purge hourly event summary data older than the specified number of days. Type the required value of days in the Older than column. By default, the value is set to seven days.
 
Daily, Weekly, Monthly (or Long Term) Event Summary Data - Lets you purge daily event summary data based on age. Type the required value of days in the Older than column. By default, the value is set to seven days.
 
Incidents, Alerts and Tickets - Lets you select incidents, alerts, and tickets for purging based on their age and state. Type the required value of days in the Older than column. By default, the value is set to seven days.
 
- Closed Incidents - Lets you purge Closed Incidents that are older than the specified number of days.
- Deleted Incidents - Lets you purge deleted incidents.
- Open Incidents - Lets you purge open incidents.
- Closed Alerts - Lets you purge closed alerts.
- Open Alerts - Lets you purge open alerts.
- Deleted Alerts - Lets you purge deleted alerts.
- Closed Tickets - Lets you purge closed tickets.
- Open Tickets - Lets you purge open tickets.
 
5. Click Purge
 
To purge all incident or event summary data
 
1. Log on to the Web configuration interface with Administrator credentials.
2. Go to Maintenance -> Backup and Restore -> Purge.
3. From the options, select Purge Incident or Event Summary Data.
4. From the Purge All view, check the options that are required for purging.
5. Click Purge All.
 
Purging selective backup files
 
In Information Manager, you can select and purge backup files. Only those backup files that were selectively backed up can be purged. You can view and select any of the components that are backed up in a .bckp file for purging.
 
Warning: In case you have used Network File System (NFS) mounted directory for
backup, during purge you must ensure that the NFS server is running. If the NFS
server is not running, ensure that the Information Manager server does not use
any NFS mounted directory from that NFS server.
 
To purge selective backup files
 
1. Log on to the Web configuration interface with Administrator credentials.
2. Click Maintenance -> Backup and Restore -> Purge.
3. From the options, select Purge Selective Backup Files.
4. From the list of backup files, select the file that you want to purge and then
click Purge
 
In order to purge events from Symantec Security Manager (4.7.3) please follow the steps below:
 
1. Login to SSIM Client
2. System
3. Server Configuration
4. Event storage Rules
5. Set the Values as per your requirement
6. The Cleanup process will be in percentage of the used space and not on date wise.
 
In order to  change how long SSIM events are kept in the event archives and to view the settings for automatic purging of event archives, please log into the SSIM UI as administrator and follow the steps below:
 
SSIM 4.5.X
 
- Click on System Tile -> Appliance Configurations -> Click on your event archive for SSIM
- In the right pane box under Archiving, there are three settings towards the bottom of the page.
- Adjust the following settings to match your environment's needs:
 
Purge After
Max Archive Quota
Free Space Quota
 
SSIM 4.6.X
 
 - Click on System Tile -> Appliance Configurations -> Expand the event archive SSIM folder
- Click on Event Storage Rules
- Click on Default Archive > or custom archives if you have created them
- Adjust the following settings to match your environment's needs.
 
Enter the data retention (days)
Max archive quota
Free space quota
 
NOTE: The settings for purging event archives in SSIM will purge events after a preset number of days or a percentage of disk quota. This will cause the oldest events to be purged to allow room for the newer events but at the same time historical events will be missing and not appearing in reports and queries.
 




Article URL http://www.symantec.com/docs/TECH193973


Terms of use for this information are found in Legal Notices