Managing the deletion of logs

Depending on the configuration of your security policies and the desired amount of logs, the log database can grow very quickly.

The following table estimates the average, minimum and maximum size of a log or a context:

  Average size Minimum size Maximum size
Log 4.5 KB 0.8 KB 10 KB
Simple context 100 KB 20 KB 600 KB
Full context 220 KB 20 KB 1200 KB

These figures are given for information. They can vary according to pool activity (e.g. applications used) and the security policies applied.

For more information on the on the contexts, Understanding what makes up a context.

There are various tools allowing you to delete logs and prevent the database from being saturated:

  • Monthly deletion of system and agent logs that have exceeded the specified retention duration.

  • Daily deletion of agent logs based on the specified criteria, performed by the maintenance task. For further information, refer to the section Configuring daily maintenance tasks.

  • Manual deletion of agent logs. You can run a manual deletion task from the System > Log Database panel as described below, or from the Agent Logs panel as described in the Deleting events section.

System and agent logs are kept by default for 12 months, or 2 months if you use SQL Server Express. The oldest logs will be deleted. These values can be changed.

  1. Select the Backoffice > System menu and click on the Log database tab.

  2. In the upper banner, click on Edit.

  3. In the section Monthly deletion of logs, choose how long (in months) you wish to keep agent events and system logs. After this duration expires, they will be deleted by an automatic task once a month.

To keep logs forever, disable monthly deletion by switching off the button. Log deletion cannot be disabled if you use SQL Server Express.

You can configure rules to delete logs daily. Every day, the maintenance task will check the criteria specified in the rules and delete logs that match all criteria:

To configure a rule to delete logs:

  1. Select the Backoffice > System menu and click on the Log database tab.

  2. In the upper banner, click on Edit.

  3. In Daily deletion of agent logs, click on Add a rule.
    The Add Daily Rule wizard appears.

  4. In the General Filtering panel, specify the criteria for deleting logs:

    Date

    You can choose whether to delete logs before a specific date, or delete all logs regardless of date.
    Severity

    You can select the log levels to be deleted. Refer to the section Managing logs.
    Status Select the status of the logs to delete. Refer to the section Managing logs.
    Application Choose whether the logs of all applications are affected, or indicate specific source or target applications.

  5. Click Next.

  6. In the Event Type panel, select the Categories or Event Types you want to delete, and click Next.

  7. In the Agents panel, select the agent groups for which you wish to delete logs. By default, all agent groups are concerned.

  8. Click on OK. The log deletion rule appears in the table.

  9. If necessary, disable one or several rules by unselecting the Status checkbox to the left of the table. Click on Hide disabled rules to remove them from the table. The rules will be executed every day during the maintenance task. The results of the latest execution appear in the Last result column.

If necessary, you can occasionally delete agent logs manually based on certain criteria.

  1. Select the Backoffice > System menu and click on the Log database tab.

  2. In the upper banner, click on Edit.

  3. In Manual deletion of agent logs, click on Configure and start manual deletion.
    The Add manual rule wizard appears.

  4. In the General Filtering panel, specify the criteria for deleting logs:

    Date Choose the logs you wish to delete by age (in days/months) or by date.
    Severity

    You can select the log levels to be deleted. Refer to the section Managing logs.
    Status Select the status of the logs to delete. Refer to the section Managing logs.
    Application Choose whether the logs of all applications are affected, or indicate specific source or target applications.

  5. Click on Next.

  6. In the Event Type panel, select the Categories or Event Types you want to delete, and click Next.

  7. In the Agents panel, select the agent groups and then the agents for which you want to delete logs. By default, all agent groups and agents are concerned.

  8. Click on Estimate volume at the bottom on the right to show the volume of logs that will be deleted.
  9. Click on Start.
    All logs that meet the specified criteria will be deleted. The results of the latest execution appear in the Last result column.

    NOTE
    The space freed up after the manual deletion will be shown in the Database size supervision and estimate chart only after the next maintenance task.

  10. Click on Run manual deletion again to delete logs based on the same criteria used in the previous delete operation.