Discard unnecessary logs
Log data pruning allows you to discard some of the generated logs according to detailed filtering criteria you set.
Before you begin
If Domains are in use, you must log on to the Shared Domain.
You can manage the amount of log data by defining log pruning filters. Log pruning is needed, for example, when a rule generates both useful and unnecessary logs. Log pruning gives you the ability to discard newly generated irrelevant logs entries on the Log Server. Only logs can be pruned: alerts and audit entries are never pruned.
It is better to adjust log generation options instead of letting log entries be generated and then pruning them. Pruning log entries after they are generated wastes system resources by creating and transferring the unnecessary logs.
- Immediate Discard filters delete log entries immediately as they arrive to the Log Server. The deleted log entries are not displayed in the Management Client.
- Discard Before Storing filters deletes log entries before they are saved. Log entries are shown the Current Events mode in the Logs view before they are deleted. This option converts Essential or Stored type log entries to Transient log entries.
You can prune log entries as soon as they arrive on the Log Server or before they are stored. When you prune log entries before they are stored, you can still view them in the Current logs view).
Use pruning with caution. The data is deleted without leaving any traces and there is no way to recover incorrectly pruned entries. Pruning also wastes resources compared to preventing the entries from being generated. Pruned entries still have to be created and transferred to the Log Server, and the Log Server still has to process them.
For more details about the product and how to configure features, click Help or press F1.
Steps
Log Data Pruning view
Use this view to configure log data pruning. Log data pruning allows you to discard some of the generated logs according to detailed filtering criteria you set.
Option | Definition |
---|---|
Resources | Use this pane to create and add elements to the Log Data Pruning configuration. |
Search | Opens a search folder for the selected element list. |
Up (Backspace) | Returns to the previous folder. |
New | Opens the associated dialog box to create a new element. |
Tools | Show Deleted Elements — Shows elements that have been moved to the Trash. |
The
Log Data Pruning view has the following tabs:
|
|
Immediate Discard | Shows the filters that cause logs to be immediately discarded. |
Add | Adds the filters selected in the
Resources pane to the
Immediate Discard list.
Tip: You can drag and drop the filters to the lists in this view.
|
Remove | Removes the selected filters from the Immediate Discard list. |
Discard Before Storing | Shows the filters that cause logs to be discarded before storing. |
Add | Adds the filters selected in the
Resources pane to the
Discard Before Storing list.
Tip: You can drag and drop the filters to the lists in this view.
|
Remove | Removes the selected filters from the Discard Before Storing. |
Info pane | Use this pane to view more information about the selected element. The available tabs depend on the type of element selected. |