App Control: How to Configure Event Retention Settings

[#1]

Environment

• App Control Console: All Supported Versions

Objective

To modify the amount and or period of days to keep events within the console/database.

Resolution

1. Navigate to System Configuration (Gear Icon) > Events tab
2. Update the values for "Delete Events Older Than" and "Delete If More Than"
3. Save changes

Additional Notes

• The more events kept, the more storage that is required and the longer queries can take.
• By default the App Control Server saves no more than 10 million Events and none older than 4 weeks.
• Warning: Before lowering this setting, it's recommended to discuss with a dedicated security team and consider the impact this may have in future security breaches
• Event data is deleted when either condition is met. You can configure these automatic deletion parameters based the available disk space on the SQL Server and your need for historical information. To determine the right values for your network, monitor disk space use and query time on the serve. Adjust the event database deletion parameters accordingly.

Related Content

App Control: How to Change Agent Event Retention
App Control: Total Events in Console Less Than Expected