Configuring Sentinel Log Manager Storage Utilization; Sentinel Log Manager Data Retention; Copying Data To Tape - Novell SENTINEL LOG MANAGER 1.0.0.5 - ADMINISTRATION GUIDE 03-31-2010 Administration Manual

Events should be archived regularly.
You should periodically export all the ESM configurations and save them. When the
environment is relatively stable, you can generate a full ESM export including the entire tree of
the ESM components. This action captures the plug-ins as well as the configuration of each
node. The resulting
If changes such as updating plug-ins or adding nodes are made to ESM later, you must export
the configuration and save it again.
Back up the entire installation directory, instead of particular sections, so there is no risk of
manual mistakes and the process is quicker.

3.7.3 Configuring Sentinel Log Manager Storage Utilization

Sentinel Log Manager allows you to configure local and archive storage space size to store data,
before it deletes the data from the Sentinel Log Manager server. Use these size limits to ensure that
your storage system is not 100% utilized, which might result in undesirable behaviors such as data
corruption. Additionally, you should also leave extra space in your archive storage so that at a later
time you can copy data from tape back into Sentinel Log Manager. By decreasing the archive
utilization setting, Sentinel Log Manager creates space to copy data back from tape.

3.7.4 Sentinel Log Manager Data Retention

Sentinel Log Manager allows you to configure the duration to keep the data on disk before it deletes
the data. If your hard drive storage space is not sufficient to store data long enough to meet your
legal requirements, you can use tape storage mechanism to store the data beyond the specified data
retention duration. Therefore, retention policies should be configured long enough to make sure the
data you want to regularly search and to report on is retained within Sentinel Log Manger, for
example the most recent 90 days worth of data. Additionally, retention policy should ensure that
Sentinel Log Manager is not prematurely deleting the data due to storage utilization limits. If the
storage utilization limit exceeds and data is prematurely being deleted, you should change the policy
to expand the data storage space.

3.7.5 Copying Data to Tape

Depending on what data you need to retain for long term, you need to setup a process to copy raw
and/or event data to tape.
The following section discusses how each type of data is stored in Sentinel Log Manager so that you
can setup copy operations to copy the data out of Sentinel Log Manager onto tape.
"Copying Raw Data to Tape" on page 43
"Copying Event Data to Tape" on page 44
Copying Raw Data to Tape
Raw data partitions are individual files. They are created every hour, and are closed within 10
minutes after the elapsed time. When a raw data file is closed, it is renamed to identify as the closed
file. Files in the open state have a
file should be backed up and archived as a normal file.
.zip
extension. When they are closed, they will be renamed to
.open
Configuring Data Storage 43