A quick one about retention of indices

Graylog Central (peer support)
1

Hi All,

We intent to keep data for a year for archive purposes.
Based on the statistics saying on average it takes half a year to discover you have been hacked. We intent therefore to keep data for a year so we are better able to respond to the GDPR needs of 72 hours report back time in case of a data breach.

Now since we only need this for arching and we intent only to look back live for 1 month. Then in order not to stress the system to much, wouldn’t it be wise to set indices rotation to P1M with a Max number of indices of 12.
That way each index would hold 1 month of data which would give us a faster search time but we will be able to go back a year if need be.

is this assumption correct?

2

Hi @i4admin,

Yes, the assumption is correct. However, you should monitor how much storage is used by the 1 month of data.

Depending on your environment setup and resources, it is recommended not to go above 40-50GB per index.

Thank you.

Regards,
Bill

3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.