IBM Guardium

IBM Guardium

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Purge issue on central manager

    Posted 07/20/20 03:47 PM
    Edited by Brian Greenwood 11/19/24 04:01 PM

    Hello,

     

    We have a funny issue.

     

    On our collectors we have the Data Export set as this:

    Export Data older than 1 Day

    Ignore Data older than 2 Days

     

    This way we are exporting data 1 day ago, and ignoring data older than that. 

     

    We are then Purging data from the Collector older than 3 days.  And we have the Checkmark checked:  Allow Purge without Exporting or Archiving.

     

    So on the Collectors, I can only see data in the past 3 days.  And the export is successfully going to the Central Manager. 

     

    The problem is that once it gets to the Central Manager, it is then only showing me the past 3 days' worth of traffic, just like at the Collector Level. It's almost like it is purging older then 3 days old at the Central Manager just like we have it set at the Collector level.

     

    On the Central Manager, we have the Data Purge under the "Data Export" set to purge Data older than 2 months.

     

    So weird.  Any idea on if I am missing something on setting the Data Purge on the Central Manager?  Any other ideas? 

     

    Thanks!!

     

     

    Brian Greenwood CPC HCISPP-A


    Privacy Information: http://privacynotice.net (data rate charges may apply) or 800-524-2621.


  • 2.  RE: Purge issue on central manager

    Posted 07/21/20 05:40 AM
    Hi Brian,

    The system that you refer to as Central Manager is also the "Aggregator" and I suppose you have defined the import schedule and parameters under Manage > Data Management > Data Import.

    Which report or view is showing you the past 3 days of trafic?
    * Is that a report and if so what parameters have you defined for this report?
    * If you have enabled and are using the Investigation Dashboard (Investigate > Search for Data Activity) please note that by default indexed search data is retained for 3 days.

    ------------------------------
    Sylvain Randier
    ------------------------------



  • 3.  RE: Purge issue on central manager

    Posted 07/21/20 06:55 AM
    Hi Brian,

    I believe data export job should not be scheduled on CM/AGG . Can you please check data archive job at CM , if it is scheduled and purge period is set there then it may also impact the data purge. If that is not a case , then how did you check that the CM/AGG have only three days of data.

    Thank you
    Sachin

    ------------------------------
    Sachin Shende
    Security Consultant
    IBM
    +91-9561-650-383
    ------------------------------



Related Content