• State Not Answered
  • Replies 2 replies
  • Subscribers 28 subscribers
  • Views 706 views
  • Users 0 members are here
Options
Related

RETENTION in SPP

dario guastella
over 2 years ago

the customer asked us if is possible to keep only the last 13 months of data in SPP and the rest could be deleted.

(i am considering all the data in the activity center)

Is it possible to configure the retention in SPP? In which way?

Parents
  • 0 over 2 years ago

    HI Dario,

    Yes you can manage the retention of Audit logs via the Audit Log Maintenance setting, please refer to the admin guide section here:

    https://support.oneidentity.com/technical-documents/one-identity-safeguard-for-privileged-passwords/6.12.1/administration-guide/89#TOPIC-1738199

    Note: The default Audit Log Maintenance configuration is to synchronize data and audit logs only on Saturday at 12 a.m. The cluster is locked during the process and other cluster operations cannot be performed.

    Depending on how much data is currently retained on SPP, you may want to gradually reduce it to 13 months:

    - For example, if the cluster has been in production for 2 years or 24 months then you can start at retaining 20 months then after the scheduled Audit log maintenance runs successfully then change retention to 16 months then allow it to run on following weekend per schedule then further change retention to 13 months.

    This way you are not archiving and purging from 24 month to 13 months (11 months worth of audit log data) all in one go.

    Thanks!

Reply
  • 0 over 2 years ago

    HI Dario,

    Yes you can manage the retention of Audit logs via the Audit Log Maintenance setting, please refer to the admin guide section here:

    https://support.oneidentity.com/technical-documents/one-identity-safeguard-for-privileged-passwords/6.12.1/administration-guide/89#TOPIC-1738199

    Note: The default Audit Log Maintenance configuration is to synchronize data and audit logs only on Saturday at 12 a.m. The cluster is locked during the process and other cluster operations cannot be performed.

    Depending on how much data is currently retained on SPP, you may want to gradually reduce it to 13 months:

    - For example, if the cluster has been in production for 2 years or 24 months then you can start at retaining 20 months then after the scheduled Audit log maintenance runs successfully then change retention to 16 months then allow it to run on following weekend per schedule then further change retention to 13 months.

    This way you are not archiving and purging from 24 month to 13 months (11 months worth of audit log data) all in one go.

    Thanks!

Children