Storage Maintenance and Archive

On the Storage Maintenance page of Server Configuration, you turn on storage retention and set up the storage archive. The Syslog Watcher Server service does both.

In the Server section of the main toolbar, click Server Server → Server Configuration Server Configuration…​, then open Storage Maintenance.

Syslog Storage Retention

Setting Initial Description

Enforce storage limits

Disabled

Delete files that exceed limits — the server checks the storage size and file age, and deletes files beyond the limits.
Disabled — nothing is deleted.

The limits themselves (Delete files older than, Maximum storage size (GB)) are set in Storage Settings.

After a migration from version 6, retention is off so that you can review the migrated limits first.

Storage Archive

The storage archive is a periodically synchronized, compressed copy of the syslog storage. Compression gives up to 10× longer retention for the same disk space, and the archive can be on a remote disk or network share.

Each sync writes zip files for the hours or days that have closed since the previous sync. Each zip holds a copy of the storage index and the message files for its period.

Setting Description

Synchronize archive

Disabled — no archive; the other archive settings are hidden.
Daily — one zip per calendar day (storage time zone), written shortly after midnight.
Hourly — one zip per clock hour, written shortly after the hour ends.

Archive location

Folder for the archive files. Required when sync is on. It can be a network path if the server service account can write to it.

Protect files with password

Optional password for the zip files. Use a secret string (%EXAMPLE%) instead of the actual password. The files use standard ZIP password protection, so Windows Explorer can extract them.

Limit archive retention

Yes, delete older archive files deletes archive files older than Keep archive files for (days) (1–36500, initial 365). It only deletes old archive files; it does not limit what the next sync writes.

Execute command after syncing

Optional command line run after each sync. See Command After Sync.

Daily and hourly archives use different file names and folder layouts. Do not switch an existing archive folder between them; use a new folder, or delete the files in the folder first.

Command After Sync

Use the command to process new archive files, for example to copy them to cloud storage. {ARCHIVE_DIR} in the command line (and in Work folder) is replaced with the archive folder.

Setting Description

Execute command after syncing

Command line. Example: powershell.exe -File C:\Scripts\Upload-Archive.ps1 "{ARCHIVE_DIR}"

Work folder

Working folder for the process.

Run as

Windows account that runs the command: DOMAIN\user, user@domain, or a local name. Leave empty to run the command as the server service account.

Password

Password for Run as. Use a secret string.

Command timeout

Seconds to wait (1–86400). A command that runs longer is stopped.

The command result is written to Server Diagnostics.

Archive Status

Click Syslog Storage on the Server tab diagram. The Syslog Archive section shows the archive folder and:

Last Sync

When the last sync ran.

Next Sync

When the next sync is due.

Duration

How long the last sync took.

Synced

Storage size → archive size written by the last sync (for example 1.2 GB → 140 MB), or Up to date when nothing new had to be archived.

A sync error is shown in red under the list. When the archive is off, the section shows Storage archive is disabled.

Viewing Archived Messages

To view messages from an archive file, extract it to an empty folder and open that folder in Manager without a server. See Open a Storage Archive File.