Go to the table of contents Go to the previous page Go to the next page View or print as PDF
Configuring General System Settings > Archiving incident partitions
Archiving incident partitions
Data Security Manager Help | TRITON AP-DATA | Version 8.1.x
Related topics:
The incident database is partitioned every 90 days. Periodically, you should archive the partitions to optimize performance.
The Data Security manager keeps a dynamic tally of incidents, which are automatically saved in a partition dubbed the Online-Active partition. Once full, that partition becomes inactive, replaced by a new active partition in order to maintain free storage for future forensics records. You can view and manage these partitions through the Data Security manager.
Select Settings > General > Archive Partitions to view a list of current partitions and their status. You can archive, restore, or delete a partition, and also set storage limits using the Settings button on the toolbar.
In the Archiving screen, the bolded first line is the active partition. You cannot archive this partition, and if you delete it, its incidents are cleared but the partition is not removed. Event partitions represent roughly 3 months, and hundreds of thousands of incidents that have traversed the data security software.
If you are using Microsoft SQL Server Standard or Enterprise for your TRITON database, you can have a maximum of 8 online partitions (approximately 2 years). Refer to Remote SQL Server machines for special instructions.
If you are using SQL Server Express, you can have one active partition for the current quarter. In addition, you can have up to 4 online partitions (approximately 1 year), 4 restored partitions (1 year), and 12 archived partitions representing 3 years of records.
The columns in the archive list are sortable.
*
Online-Active - local incidents are dynamically stored here until the repository is full
*
Online - once the Online-Active partition is full, a new Active partition begins to collect new incidents. The original Active partition is no longer active, but is retained here with its Online status.
*
Archive - partitions that have been archived in an offline location.
*
Deleted - partitions that have been permanently deleted.
*
Restored - partitions that were restored to Online from having been archived.
Toolbar buttons
You can select partitions and then archive, restore, or delete them by clicking the respective buttons in the toolbar:

Go to the table of contents Go to the previous page Go to the next page View or print as PDF
Configuring General System Settings > Archiving incident partitions
Copyright 2016 Forcepoint LLC. All rights reserved.