Change Guardian stores raw data and compressed event data on the local file system. You can configure Change Guardian to store the data in a networked location for long-term storage.
The data files are deleted from the local and networked storage locations on a configured schedule. Raw data retention is governed by a single raw data retention policy. Data retention is governed by a set of event data retention policies, which the Change Guardian administrator configures. By default, Change Guardian retains event data for 30 days.
Change Guardian uses the same data storage and retention policy technology as NetIQ Sentinel. For more information, see “Configuring Data Storage” in the Sentinel Administration Guide.