Security Compliance

Change default syslog retention value in SEM

This article describes how to increase the default syslog retention settings from the default value of 50 days to any value under 100 days. This means that syslog-ng will start dropping files when the count reaches 100, starting with the highest number.

First published date

10/29/2018 8:25 PM

Last published date

3/30/2023 4:15 PM

Overview

This article provides steps to increase the default syslog retention settings from the default value of 50 days to any value under 100 days. This means that syslog-ng will start dropping files when the count reaches 100, starting with the highest number.

Product section

Security Event Manager

Cause

N/A

Resolution

  1. Log in to the CMC Console using the following:
    • user name: cmc
    • password: password (or the password you have set)
  2. Enter appliance.
  3. Enter limitsyslog.
  4. Follow the instructions to change the retention period from 50 days to any value between 0-100 days.
 

Note:

  • This will not have any impact on how data retention settings of a normalized alert DB, which is what LEM uses for nDepth search and Reports.
  • Ensure that your SEM has enough space in the log/data partition.
  • Watch for any abnormal syslog file size growth as it can fill up the log/data partition quickly if left unchecked.