Search the ManageEngine site:  
 

Help Center

Quick Start

File Auditing

File Analysis

Data Risk Assessment

Endpoint DLP

Cloud Protection

General settings

Policy Configuration

Release notes

Troubleshooting

Guides

Third-party software Contact us

Archive endpoint events

Audit data that is older than a specified time range can be cleared from the primary database, zipped, and archived. Archiving allows you to manage disk space and limit database growth.

The archive process only moves the data from the database to a secondary location; it does not delete the event data. You will still be able to generate reports and analytics for it by loading the archived events onto the console when necessary.

The archive process will happen automatically at user-specified intervals. The schedule runs at 2am to minimize disruptions to your environment.

Editing archive schedules

To view and edit the archive schedule configuration, follow the steps below.

  • Log in to the DataSecurity Plus web console as an administrator.
  • Select Endpoint DLP from the applications drop-down.
  • Navigate to Configuration > Storage Management > Archive Events. The table will show various audit event categories, the size of data in each, the interval (in days) after which each will be archived, and the number of events that will be archived at the next scheduled archive.
  • To modify the archive schedules for audit data, enter the number of days after which you want to run the schedule. You can schedule archival at different intervals—between one and 180 days—for each of the below event categories.
    • Audit reports
    • Email audit reports
    • Printer audit reports
    • Classification reports

You can also choose to run the schedule at any point between the configured intervals by clicking the Run Now option on the right side of the page.

Note: If the number of events in a category exceeds 3 million, then those events will be archived automatically, even if the specified interval has not been completed. This event archive schedule will run at 2am as well.

Modifying the archive location

The archives can be stored locally on the file server or on a shared drive.

By default, the archived event data will be saved to C:\Program Files (x86)\ManageEngine\DataSecurity Plus\apps\dataengine-xnode\data\archive\endpoint-audit.

To modify this, follow the steps below:

  • Navigate to Endpoint DLP > Configuration > Storage Management > Archive Events.
  • Provide the new path in the Archive Folder Location field.

Best practice: We recommend changing the archive location as infrequently as possible to enable easier management and ensure faster retrieval.

Topics in this page:

Don't see what you're looking for?

  • Visit our community

    Post your questions in the forum.

     

  • Request additional resources

    Send us your requirements.

     

© 2024 Zoho Corporation Pvt. Ltd. All rights reserved.