App Control: How to Change Agent Event Retention
book
Article ID: 286503
calendar_today
Updated On:
Products
Carbon Black App Control (formerly Cb Protection)
Issue/Introduction
To change the number of events an Agent keeps before purging.
Environment
- App Control Console: All Supported Versions
- App Control Agent: All Supported Versions
Resolution
- Log in to the Console and navigate to https://ServerAddress/agent_config.php
- Click Show Filters > Value > contains > report_event_max_size > Apply
- Click View Details (pencil icon) and adjust the Value accordingly. Example:
report_event_max_size=7500
- Verify the Status shows as Enabled, then click Save.
- Change the Filter > Value > contains > report_event_prune_percent > Apply
- Click View Details (pencil icon) and adjust the Value accordingly. Example:
report_event_prune_percent=8
- Verify the Status shows as Enabled, then click Save.
Additional Information
- These settings are set to Disabled by default which forces the hardcoded values specified.
- By default the max Events stored are 5,000 (report_event_max_size=5000)
- By default the max percentage of Events pruned is 10% (report_event_prune_percent=10)
Feedback
thumb_up
Yes
thumb_down
No