Configuring Data Retention Policies; Raw Data Retention Policy; Event Data Retention Policies - Novell SENTINEL LOG MANAGER 1.0.0.5 - ADMINISTRATION GUIDE 03-31-2010 Administration Manual

11 After copying the files, select the Copy Done option to start data archiving to the new location.
12 Click Cancel to return to the previous archive configuration.

3.3 Configuring Data Retention Policies

You can configure one or more data retention policies to control the duration for which specific
types of events are retained in the Sentinel Log Manager. A retention policy contains a filter that is
used to identify the events for which the retention policy applies and the minimum and maximum
number of days these events should be kept in the system. Except for the Raw Data Retention policy,
all of the configured policies apply to the event data.
The configured retention policies are displayed in the Data Retention policy table. By default, data
retention policy is refreshed every 30 seconds to reflect the changes made by multiple users. For
every 30 seconds, the refresh operation synchronizes the policy table and reflects the changes made
to the retention policies by multiple administrators.
Section 3.3.1, "Raw Data Retention Policy," on page 34
Section 3.3.2, "Event Data Retention Policies," on page 34
Section 3.3.3, "Rules for Applying Appropriate Retention Policy," on page 37

3.3.1 Raw Data Retention Policy

The raw data retention policy controls how long the raw data is kept in the system before being
deleted. The data retention policy table contains a raw data retention policy. Like the default data
retention policies for events, the Raw Data Retention policy cannot be deleted or disabled. However,
you can change the Keep at most (number of days after which the raw data file is deleted) and Keep
at Least (minimum number of days the raw data file is kept) values.
The process to delete raw data runs when the server is started, for every one hour (because the raw
data files are closed every one hour), and whenever the Keep at most value is changed. All the files
exceeding the retention time are removed permanently from the local and archive storage locations.

3.3.2 Event Data Retention Policies

The event data retention policies control how long different types of event data are kept in the
system before being deleted.
"Adding a Data Retention Policy" on page 34
"Activating or Deactivating a Data Retention Policy" on page 36
"Editing a Data Retention Policy" on page 36
"Deleting a Data Retention Policy" on page 36
Adding a Data Retention Policy
1 Log in to the Sentinel Log Manager as an administrator.
2 Click the storage link in the upper left corner of the page.
The Storage tab appears on the right pane of the page.
3 Click the Configuration tab.
34 Sentinel Log Manager 1.0.0.4 Administration Guide