Overview

Storage management in GFI EventsManager can be challenging when the database is rotating as the disk can get full of databases and the administrator will be switching all the time between databases to find the required events for reporting. This article outlines an alternative to database rotation, controlling database growth and keeping only one database with the most recent events in it.

You may also refer to the article Releasing Space When Databases Exhausted the Drive for additional information.

Process

Deleting events from GFI EventsManager is a two-step process:

1. Mark Old Events as Deleted.

   Events we want to remove must be marked as deleted, this way Events Browser will not show them when querying it. Unfortunately, that will not free up disk space, events will still be stored in the database even when not displayed.
   There are two ways to accomplish this, automatic or manual event deletion:
   
   

   Manual Deletion:

   1. Open your GFI EventsManager Console and go to the Events Browser tab.
   2. Select All Events view and click on the Create View link on the left.
   3. Give the view a name (e.g. Old events) and click on Add to add a restriction.
   4. Select the date field and use an operator either Less than or Occurred and the proper timeframe to view the events you want to delete.
   5. Click OK twice. The new view should list all the events you want to delete from the database.
   6. While using the new view, click on the Mark events as deleted link on the left.
   7. Click Yes on the confirmation window.
      
      

   Automatic Deletion:

   1. From your GFI EventsManager Console, go to Configuration Tab > Database Operations.
   2. Click on Create new job and click Next.
   3. Select Import\Export Job and click Next.
   4. Next, select Export to file and click Next.
   5. Select a folder to export the Events to (this folder will contain a backup of all the events deleted. If there is no need to back them up, the files can be deleted on a regular basis).
   6. Click Next.
   7. If you want to encrypt the files, check the Encrypt Exported Data option and set the password.
   8. Click Next.
   9. Clear the Export All Events option, select Events Older Than option and set the timeframe (e.g. 2 Months).
   10. Check the Mark events as a deleted option and click Next.
   11. Select Scheduled job and/or Run the job now as required and click Finish (Scheduled job is preferred).
       
       

2. Commit Database Deletions.

   The events marked as "deleted" will be physically removed from the database and files will be compacted so disk space will be released. Refer to the article Creating Commit Deletions Job for the complete steps.

When both steps are completed, the main database will contain only events in the desired timeframe and will use the least disk space for storage.

Related Articles

• Managing Events Browser views
• Exporting to File