NFS Archiving Questions

[virtech]

I have a couple of questions regarding archiving:

1. There doesn't appear to any configuration available defining when events are archived, i.e. Archive events older than 6 months to an NFS location.

My interpretation is that events are only archived when the appliance is starting to run out of space, i.e. 3% and below?

2. Importing an archive for searching appears to be very cumbersome by mounting the NFS data and then importing it into the Log Insight appliance, is this still the case in the latest version?

[sflanders]

1. No configuration today -- archiving happens near real-time, not at the 3% mark. See this post: Log Insight System Architecture Part 3: Archiving - SFlanders.net

2. Yes -- when the importer (new in LI 3.3) supports the archive blob, this will become easier.

[virtech]

Thanks for that, will there be any future configuration options around NFS archiving? 

[sflanders]

Likely based on https://loginsight.vmware.com. So two things currently on the list"

• Variable retention periods-- archive based on partition
• Tiered online, searchable data storage-- tiered storage