With the new Data Retention settings introduced in 26.03, my assumption was that once enabled, it would clean up old logs and retain only those from the last X number of days. This does not appear to be the case, as I still have several million SIEM records dating back to the first day the system was deployed over two years ago. Is this an issue unique to my deployment? Is this a bug? Or is this by deign?
I was informed it cleans up 10,000 log entries/day by default. There is a way to increase this number, but it is not one mass dump of old logs as I’d imagined.
Hi Carol,
Correct, we only delete 10k/logs per day. We do have a way to increase how often we do a deletion.
At this location, C:\ProgramData\Stealthbits\PAM\WebService the appsetting.json file can be updated. Under JobSettings, you can add a DataRetentionCleanupTimerMinutes parameter and make it 60. Reboot to have it take.
The default is 1440, or once a day. By making it 60 min, it will delete the 10k logs every hour. Don’t go lower than 60 to ensure we don’t slow something down. We will make this more flexible in the future.
Best Regards,
Billy VanCannon