Managing data: archive, restore, aggregation, and system backup

Establish data retention practices; control activity volume; manage scheduling of data archive and purge, and monthly backups.

Planning archiving, storage capacity, and scheduling
Learn about archiving and purging, and capacity and scheduling planning, so you can configure archiving and purging on your system.
Managing stored data
Typically, no more than one or two months worth of audit data is stored on an appliance (or as little as a few days), to save disk space and maintain performance. However, auditors might require to keep audit data available for a few years. Guardium® provides the mechanism to archive audit data in chunks of one day and store them on a remote location. Configure the archive process during implementation to run daily. Configure archive and purge as part of your overall data management policy. Learn how to archive, and export and import data from collectors to aggregators.
Exporting (files) results
CSV, CEF, and PDF files can be created by workflow processes. This function exports all such files that are on the Guardium system to the target system you specify.
Viewing days whose data was not archived or exported
The predefined report Days that are not archived or exported shows the days whose data remains on the appliance, and will not be purged based on the Guardium system settings.
Data and Result catalogs
Each Guardium system can have both a Data catalog and a Result catalog. The catalogs list all archive files that were created on the server. Each time the system archives data or results, one entry is added to the relevant catalog. Each archive file is tracked, so that it can be retrieved and restored.
Data aggregation
Collect and merge information from multiple Guardium units into a single Guardium Aggregation appliance to offload the reporting and analysis function from the collectors, while also providing a consolidated view of the data from multiple collectors.
Purging data
Data that has been successfully archived should be purged from the Guardium appliance to maintain the disk space. Configure and schedule the purge mechanism during the implementation stage to run nightly: to purge data that is older than a specified number of days.
Configuring system backup
System backups store all the necessary data and configuration values to restore a Guardium Server. Configure and schedule regular system backups during the implementation stage.
Restoring a Guardium system
Each type of guardium system (collectors, aggregators, and central manager) have different purposes and store data in different ways. Use the appropriate recovery strategies for each system type. The recovery strategy that is used also depends on whether the system that must be recovered is a stand-alone appliance or is used with other systems.
Enabling SSH key pairs for data archive, data export, data mart
You can use SSH key pairs for authentication, instead of passwords, for archiving and exporting results, archiving data, and exporting data marts.
Transferring data to a remote host by using SSH key pairs for authentication
You can archive and export results, archive data, and export data marts with SSH key pairs for authentication, instead of usernames and passwords.
Configuring external storage
Archive files can be sent using SCP or FTP protocol, or to a configured external storage system (Amazon S3, EMC Centera, Tivoli Storage Manager, IBM COS, and IBM Cloud). You can define a single archiving configuration for each Guardium system.

Parent topic: Configuring your Guardium system