Novell SENTINEL LOG MANAGER 1.0.0.5 - 03-31-2010, Administration Manual

Page: 35 / 168

Configuring Data Storage 35
no
vd
ocx
(e
n)
19
Fe
bru
a
ry
20
10
4 In the Data Retention section, click the Add a policy option located at the top right corner of the
policy table.
5 Specify a name for the retention policy.
The policy name must be unique and must contain alphanumeric characters. If a duplicate
policy name is specified an error message is displayed when you save the retention policy.
6
Specify a filter value. The filter value uses the same syntax as searches.
For example, the filter field contains a filter such as
sev:[3 TO 5] AND
(evt:"SyslogNICListener") . This filter value matches all the events with a severity of 3, 4 or 5
and event name
SyslogNICListener
.
For more information, see Section 5.1.2, “Running an Advanced Search,” on page 77 .
7
Click the show tips link to view the tag names that can be used for defining the retention policy
filter.
For example, use
sev:[0 TO 1] to define a retention policy that applies to all events with a
severity of 0 or 1.
8 Specify the minimum number of days to retain the events in the system in the Keep at least
field. The value must be a valid positive integer.
9 (Optional) Specify the maximum number of days for which the events should be retained in the
system. The value must be a valid positive integer and must be greater than or equal to the
Keep
at least value. If no value is specified, the system retains the events in the system until the space
is available.
10 Click Save . The newly created policy is displayed under the data retention table.
The table also contains the following additional columns:
Š
Size: Displays the amount of space used to store the events for the respective retention
policy.