Hi

The events data retention can be configured to either of

When storage space is required

Keep data placed in this bucket for

Why there is not option to 'Keep data placed in this bucket for' BUT if necessary, delete old events ?

For example, normally we want to keep data for X time, but sometimes the data in /store exceeds 85% and then the appliance to stop working and manually deletion is needed in order to come back to normal

Hi,

Those two options that you have mentioned is NOT either of rather you need to configure both.

For how long you want to retain the data (aka, retention period) is defined by the retention property “Keep data placed in this bucket for” and

what will happen to the data after retention period is defined by the retention property “Delete data in this bucket”

Now “Delete data in this bucket” provides you two options

(1) When storage space is required

(2) Immediately after the retention period has expired

Let me try to explain using your example that you have already shared.

So, you have configured your retention bucket for X month(s) and also you have configured the retention property “Delete data in this bucket” to “When storage space is required”.

But even after your /store is hitting 85%, the data is not getting deleted?

If so, most likely the reason would be the current data in /store partition are still within the retention period. QRadar does not delete data within the retention period.

If you have investigated and found out that the data is out of your retention period and still it is not getting deleted, then it could be a problem and in that case, I would suggest you to open up a QRadar support ticket for further investigation.

For more information about the retention buckets, please read:

https://www.ibm.com/docs/en/qsip/7.4?topic=retention-configuring-buckets

Hope it helps.

Hi, thanks for the response.

So QRadar does not delete data within the retention period. But if it is out of the retention period and there is still storage left ?

There are two options here:

(1) Immediately after the retention period has expired - This option will delete the data which are out of retention period even if there is storage space available in /store

(2) When storage space is required - This option will NOT delete data if there is storage space available in the /store even if your data has crossed the retention period. This could happen in an oversized appliance where you have too much of /store space even after storing all the data for required retention time period.

The option I was looking for is combined -

Delete all data immediately when it's retention period has expired BUT if storage is needed, delete the oldest.

Is that possible ?

I am not sure what you are trying to achieve here but the two options are either or. You cannot choose both options at the same time.