Filter
Top Products
11-25
User Guide for Cisco Security Manager 4.4
OL-28826-01
Chapter 11 Configuring Security Manager Administrative Settings
Event Management Page
Extended Store Management Options
Auto Copy Events to
Extended Store
Whether you want to define an extended storage location for event
storage. Events are copied from the regular event storage location to the
extended location so that they remain available for use. When you
query for historical events in Event Viewer, events in the extended
storage location are automatically retrieved if they are needed.
Tip You are prompted to verify that you want to start the extended
service and to make changes to the extended storage location.
Extended Data Store
Location
The location of the extended data store for events. This location can be
on directly-attached storage that appears as a drive on the server and
that uses DAS protocols. For example, SAN storage attached through
fiber channel. CIFS storage is not supported. Click Browse to select the
desired drive and directory.
Tips
• When you select an extended storage location and save your
changes, Security Manager checks that it can be accessed and that
it has write permissions. The primary storage location is used as a
reference, and any data that exists in the primary storage location
that does not exist in the extended storage location is copied to the
extended storage location. Any data that already exists in the
extended storage location is not evaluated and is left untouched,
although it can be deleted later to make room for new data.
• If you change the extended data store location, you cannot query
events that exist only in the previous extended data store location
(that is, you cannot query events that have already be removed from
the primary location). If you want to preserve these events, copy
the data from the old location to the new location.
Extended Data Store Disk
Size
The amount of space you want to allocate to the extended event storage
location, in gigabytes (GB). Events are incrementally deleted (rotated
out) from the extended store when it becomes 90% full. The size must
be equal to or larger than the primary event data storage location.
You can see a visual representation of the amount of space currently
used for event data. Open the Event Viewer (Launch > Event Viewer),
then from Event Viewer, select Views > Show Event Store Disk
Usage.
Table 11-13 Event Management Page (Continued)
Element Description