How are Agent Events deleted

Products

• Data Loss Prevention Endpoint Prevent

Issue/Introduction

When are deleted agent events removed from Oracle?

Resolution

There is an agent event task that runs nightly.  It is similar to task that runs for incident deletion.

Every Night the following purges are done:

1. Delete Agent events where isDeleted = 1 ( agents marked as deleted)

2. Delete Agent status for agents that no longer exists and have not been deleted.

3. Deleted Agents marked as isDeleted.

4. Delete Agent events older than one week from the query execution time where islatest!='Y'.

The purge of agent events older than one week is based on a setting in the Manager.properties file:

# Flag to indicate if events will be purged

com.vontu.manager.purgeAgentEvents=true

# Time in which to purge system events. In days

com.vontu.manager.agentEventDelete.period=7

 

 

 

Additional Information

Customer may come up with additional queries like what can be the Maximum value for Agent Event retention period.

Ans: It depends on the environment, if they are getting only a few thousand events daily then it won't matter much, and they can increase the value as per their need. If they are getting million events for example, then it will impact database performance as these are all inserts and deletes from the database so this could heavily impact performance. You can check the number of events coming in and being deleted and increase the value accordingly for com.vontu.manager.agentEventDelete.period setting.