Configuring archive storage

Data Security Manager Help | TRITON AP-DATA | Version 8.1.x

The incident database is partitioned quarterly. Archiving partitions optimizes performance. To specify where to store the incident archives and how much disk space to allow:

Select Settings > General > Archive Storage.

Complete the fields as follows:


Field	Description
Store archive locally	Select this option if you want to store the incident archive on the local machine.
Archive folder	The location where your archive will be stored, Websense\archive. This is configured during installation and cannot be changed.
Maximum archive disk space	The maximum amount of disk space allocated for archive storage (uneditable). *See below for guidelines on estimating how much disk space you'll require.
Store archive remotely	Select this option if you want to store the incident archive on a remote machine in your network.
Use existing storage location	Use the drop-down menu to select a previously configured storage location. Click Delete to remove unneeded locations.
Name new storage location	Select this option to define a new storage location. Enter a name for the new location.
IP address or hostname	Enter an IP address or hostname for the machine on which the storage will be located.
Domain	Enter the domain name.
User name	Enter the user name needed for location access.
Password	Enter the password needed for location access.
Archive folder	Type a folder name for the new archive. For example: Websense\archive. Do not include preceding or trailing backslashes. The folder is relative to the IP or hostname that you entered.
Test Connection	Click Test Connection to make sure the TRITON AP-DATA server can access the storage location. This ensures the path is valid (hostname and folder) and also checks the access credentials.
Description	If desired, enter a description for the archive location.
Maximum archive disk space	Select a limit on the storage drive for disk space used by the archive. *See below for guidelines on estimating how much disk space you'll require.

Click OK to save your changes.

To archive partitions, select Settings > General > Archive Partitions.

*Disk space calculation

The amount of disk space that you'll need for the incident archive depends primarily on:

The total size of the transactions resulting in incidents—in other words, the size of the email messages, HTTP posts, printed files, and so on, that violated policy.

Estimate total transaction size using the following formula:

(number of incidents per quarter) * (average transaction size) * 12

You multiply the product by 12, because the system allows 12 archived partitions or 3 years of data.

To see the number of incidents you've had this quarter, view the Incident Trends report (Main > Reporting > Data Loss Prevention > Incident Trends). To see the number and size of audited Web and email transactions, view the upper right corner of the Dashboard (Main > Status > Dashboard).

The size of the metadata for the incidents

The metadata kept for DLP incidents also influences the size of the incident archive. The metadata size can vary depending on the number of policies you use and the complexity of your incidents. Incident complexity is a factor of the number of policies, rules, content classifiers, and violation triggers that are involved. Generally, metadata takes no more than 10-20 bytes of information per incident. Use the Incident Trends report to gain visibility into the number of DLP incidents.

Estimate expected metadata size using the following formula:

(number of incidents per quarter) * 20 bytes * 12

The total disk space you require then, is the sum of the first and second result.

Depending on these factors, an archive containing 100,000 incidents could be between 10-20 MB and 1 GB.