Juniper STRM 2008.2 - RESTORING YOUR DATA 6-2008 Troubleshooting Tips page 4

4
Step 7
Step 8
Release 2008.2
payload_flows~0_0~eb8d3826c5724b01~b56774a558286d05
payload_flows~10_0~ecfb94ded5814c4d~9c5d33d0ec9ec0a6
payload_flows~1_0~94fca21391be44ea~bd32d5dbe8c6a60a
payload_flows~11_0~4d98ae53d2354d41~bde1b8f0684e3829
payload_flows~12_0~2c45af65412c41c6~af424b6b3e5c2e48
payload_flows~13_0~388fe28e9484859~8ca4462103a72bfb
payload_flows~14_0~3e2c90e566d442ca~b7bb031ae09876db
payload_flows~15_0~d382f047a5164281~b2d99a661a9a8e28
payload_flows~16_0~3e18d2a93a1746ca~914d4395a0756c4b
payload_flows~17_0~13383fec3302441f~b237970768894b79
payload_flows~18_0~dcaa5df8d3764c65~a125bd6ca4cd3b76
payload_flows~19_0~d1ea417c7faf4551~869ef92249918994
Verify the restored data is now available:
Log into the STRM interface.
a
Click the Event Viewer or Flow Viewer tab.
b
Select Search > Edit Search from the drop-down list box.
c
The search window appears.
In the Time Range box, select the Specific Interval option.
d
Specify the data of the data you just restored in
e
Click Filter.
f
View the results to verify the restored data.
g
Optional. If your data retention for this type of data is configured for a time of period
that is less than the data you just restored (for example, 1 month and the data you
restored is 2 months old), then the STRM disk maintenance utility automatically
deletes this data at 2am of the following day. To avoid the automatic deletion of the
restored files, you can increase your disk retention settings to include this time
period or use the following procedure to mark restored data as protected to ensure
the files are not deleted:
Note: Increasing your disk retention period may impact the available disk space on
your system.
Open the following file:
a
/opt/qradar/conf/diskmaintd.conf
An example of the file includes:
cat diskmaintd.conf
# Diskmaintd configuration file. Currently only supported
section is the
# list of files/directories to not cleanup.
#
Step 5.