Estimating required disk space for EDR backups of event data

Products

• Endpoint Detection and Response
• Advanced Threat Protection Platform

Issue/Introduction

Our EDR backups failed due to insufficient disk space, which displays the following error.  How can we estimate the space required for the backup destination server?

Sample Error:

Backup error message "Status of Last Backup" reports "Error at 2021-XX-XX XX:XX:00 UTC" 

 

 

Environment

Any EDR version where backups are supported.

Cause

Most frequent causes are:

• Insufficient disk space
• Invalid user credentials

 

Resolution

Open the EDR console and select the following to inspect the event storage space:

• Settings
• Appliances
• Select the appliance (show appliance details)
• Hover mouse over "Green" portion of "Event Storage Usage" bar as shown:

Additionally, we suggest you:

• estimate the sizing based on how many archival backups you may need.
• write a script to prevent multiple backups from filling up the backup disk.

 

Additional Information

The actual backup file size will be less after compression. 

If the disk storage is not an issue, please verify the user credentials on destination backup server.