Identity-Based Microsegmentation Guide
LAST UPDATED: July 9, 2021

Modifying data retention defaults

Overview

You can use Voila to modify the following Microsegmentation Console data retention defaults.

  • Monitoring

    Description Default Command to modify Notes
    Logs (Loki) 672h set_value global.retention.monitoring.logs Value must be a multiple of 168.
    Metrics (Prometheus) 720h set_value global.retention.monitoring.metrics
    Traces (Jaeger) 168h set_value global.retention.monitoring.traces
  • Databases

    Description Default Command to modify Notes
    Activity logs 2160h set_value global.retention.databases.activityLogs
    Archived objects 2160h set_value global.retention.databases.archivedObjects Deleted Microsegmentation objects, such as processing units
    Event logs 2160h set_value global.retention.databases.eventsLog
    Flow report cache 48h set_value global.retention.databases.cachedReports
    Metrics (VictoriaMetrics) 2160h set_value global.retention.databases.metrics
    Reports 2160h set_value global.retention.databases.reports Includes FlowReport, AccessReport, AuditReport, CounterReport, DNSLookupReport, EnforcerReport, FileAccessReport, PacketReport, and ConnectionExceptionReport

Modifying a data retention value

  1. From your Voila host, use the following command to activate Voila.

    cd microseg && ./activate
    
  2. Provide your key at the prompt.

  3. Referencing the tables in the Overview, issue the command that corresponds to the setting you wish to modify, the desired retention period, and override. In the example below, we set the retention period for flow logs to 48 hours.

    set_value global.retention.databases.cachedReports 48h override
    
  4. Implement the change in settings.

    doit
    
  5. If you do not wish to modify any other settings, deactivate Voila.

    exit