If secondary storage is enabled, Sentinel copies the event data to the secondary storage location after two days, and a local copy remains on the primary storage until the free space on the local storage needed for storing newer event data.
Sentinel moves the raw data to the secondary storage location after approximately one hour.
To configure disk space usage:
From Sentinel Main, click Storage > Events.
In the Disk Space Usage section, the Primary storage size field displays the total storage size currently used by Sentinel.
Specify the primary storage utilization values in the following fields:
Start deleting data from primary storage when __% full: Specify the threshold at which the event data deletion process should start.
Reserve disk space for about a days' worth of event data so that the deletion process has sufficient time to complete. Also, if any other processes need to be able to store data to the same partition, those processes should have sufficient space to do so.
Stop when __% full: Specify the threshold below which the disk space cleanup process should stop. The amount of freed disk space should be sufficient to store an additional full days' worth of event data.
Sentinel stores as much event data on primary storage as possible to ensure that searches run as quickly as possible. The values specified here help to ensure that primary event storage does not get too full, but that as much data as possible is available on that partition for faster searching. The cleanup process runs once a day, checks the “start deleting” threshold and, if disk space usage is higher than that threshold, begins deleting older event data first until the disk space usage is below the second threshold.
The Secondary storage size field specifies the value of the secondary storage space.
NOTE:This field is displayed only if you have enabled secondary storage.
(Conditional) If you have enabled secondary storage, specify the secondary storage utilization value in the Use __% of total secondary storage size field. This is the threshold at which Sentinel stops using the secondary storage disk space.