Novell SENTINEL LOG MANAGER 1.0.0.5 - 03-31-2010, Руководство администратора

Страница: 26 / 168

26 Sentinel Log Manager 1.0.0.4 Administration Guide
no
vd
ocx
(e
n)
19
Fe
bru
a
ry
20
10
3.1.3 Archiving
Archiving is the process of copying closed data files from the local storage location to the archive
storage location. The original files are retained on Sentinel Log Manager to facilitate faster searches;
however, if the Sentinel Log Manager server disk space usage nears a user-defined threshold,
duplicate data files are deleted from the Sentinel Log Manager server.
Archiving processes are applied to both the raw data and event data.
Š
“Raw Data Archiving” on page 26
Š
“Event Data Archiving” on page 26
Raw Data Archiving
A raw data file is in one of the following three states at the online location:
xx.open: A file to which data is currently being written.
xx.log: A file to which data is no longer being written. This type of file has not been compressed yet.
xx.zip: A file that is already been compressed. The compression process runs every 10 minutes, by
default. These files appear in both the online and archive locations if archiving is configured and
enabled.
If data archiving is configured and enabled, compressed raw data files are copied in every 15
minutes to the configured archive location.
For more information about raw data storage, see “Raw Data Storage” on page 22 .
Event Data Archiving
The event data stored on the Sentinel Log Manager server are archived if data archiving is enabled
and configured.
/data/eventdata/
YYYYMMDD_<classid> A partition consists of the events for a single day (midnight-midnight UTC)
within a given data retention class and is held within a sub-directory named
YYYYMMDD_<class-id>.
Where,
YYYYMMDD: is the UTC date stamp.
<class_id>: is a UUID identifier associated with the data retention class.
/data/eventdata/
YYYYMMDD_<class_id>
/events.evt The events.evt directory contains the binary event data for the partition.
The format of the binary event data is stored as a Reliable Persistent
Random Access Compressed Stream.
/data/eventdata/
YYYYMMDD_<class_id>
/index
The index directory contains the lucene index for the partition.
Directory structure Description