Novell SENTINEL LOG MANAGER 1.0.0.5 - ADMINISTRATION GUIDE 03-31-2010 Administration Manual

Also see for SENTINEL LOG MANAGER 1.0.0.5 - 03-31-2010: Installation guide

Contents

Novell SENTINEL LOG MANAGER 1.0.0.5 - ADMINISTRATION GUIDE 03-31-2010 Administration Manual Manual pdf 43 page image

Configuring Data Storage 43novdocx (en) 19 February 2010Events should be archived regularly. You should periodically export all the ESM configurations and save them. When theenvironment is relatively stable, you can generate a full ESM export including the entire tree ofthe ESM components. This action captures the plug-ins as well as the configuration of eachnode. The resulting .zip file should be backed up and archived as a normal file.If changes such as updating plug-ins or adding nodes are made to ESM later, you must exportthe configuration and save it again. Back up the entire installation directory, instead of particular sections, so there is no risk ofmanual mistakes and the process is quicker.3.7.3 Configuring Sentinel Log Manager Storage UtilizationSentinel Log Manager allows you to configure local and archive storage space size to store data,before it deletes the data from the Sentinel Log Manager server. Use these size limits to ensure thatyour storage system is not 100% utilized, which might result in undesirable behaviors such as datacorruption. Additionally, you should also leave extra space in your archive storage so that at a latertime you can copy data from tape back into Sentinel Log Manager. By decreasing the archiveutilization setting, Sentinel Log Manager creates space to copy data back from tape.3.7.4 Sentinel Log Manager Data RetentionSentinel Log Manager allows you to configure the duration to keep the data on disk before it deletesthe data. If your hard drive storage space is not sufficient to store data long enough to meet yourlegal requirements, you can use tape storage mechanism to store the data beyond the specified dataretention duration. Therefore, retention policies should be configured long enough to make sure thedata you want to regularly search and to report on is retained within Sentinel Log Manger, forexample the most recent 90 days worth of data. Additionally, retention policy should ensure thatSentinel Log Manager is not prematurely deleting the data due to storage utilization limits. If thestorage utilization limit exceeds and data is prematurely being deleted, you should change the policyto expand the data storage space.3.7.5 Copying Data to TapeDepending on what data you need to retain for long term, you need to setup a process to copy rawand/or event data to tape.The following section discusses how each type of data is stored in Sentinel Log Manager so that youcan setup copy operations to copy the data out of Sentinel Log Manager onto tape. “Copying Raw Data to Tape” on page 43 “Copying Event Data to Tape” on page 44Copying Raw Data to TapeRaw data partitions are individual files. They are created every hour, and are closed within 10minutes after the elapsed time. When a raw data file is closed, it is renamed to identify as the closedfile. Files in the open state have a .open extension. When they are closed, they will be renamed to