Skip to content
  • There are no suggestions because the search field is empty.

How to set the archiver data retention to run at a custom time in RSA Security Analytics 10.6

Issue

For RSA Security Analytics 10.6 and above, the Data Retention tab under Administration -> Services -> Archiver -> Config and only allows users to set the Duration and not the time at which the retention rule is set to be run.

Resolution

To achieve this, follow the steps below.
 
  1. Navigate to Administration -> Services -> Archiver -> Explore.
  2. Expand sys -> config.
  3. Right-click on scheduler and select Properties.
  4. In the drop down, select addMil and paste the following in the Parameters field:
    pathname=/archiver/collections/default/database time=12:00:00 daysOfWeek=all msg=timeRoll params="type=meta,packet,session days=365"

This will run the retention scheduler at 12:00:00 everyday and roll over all entries older than 365 days.

Product Details

RSA Product Set: Security Analytics, NetWitness Logs and Packets
RSA Product/Service Type: Archiver
RSA Version/Condition: 10.6.x

Approval Reviewer Queue

ASOC Approval Group