How long events are stored on the server

This section lists the maximum duration of storing events on the server. The actual storage duration depends on the number of events. If there are too many events, the most recent events overflow the storage and, as a result, older events are deleted earlier.

The maximum duration of storing events is determined according to the following rules:

• If an event is used for generating reports and/or widgets (in the notification settings, such events are grouped under Recommended events), its storage duration depends on the exact report that uses the event:
  • If the event is used by the Detections by Web Control component report, it is stored for not more than 1 day.
  • If the event is used by the Network attacks report, it is stored for not more than 7 days.
  • If the event is used by any other report, it is stored for not more than 30 days.
• If an event is not used for generating reports and/or widgets, its storage duration depends on whether you have enabled the notifications about this event (in this case, in the notification settings such events are grouped under Optional events) or on whether notifications about this event are not available at all (in this case, such events are not present in the notification settings).
  • If notifications about the event are enabled, its storage duration depends on the event severity:
    • A critical event or a functional failure is stored for not more than 7 days.

      Exceptions:

      • The Network activity blocked event is stored for not more than 1 day.
      • The Application startup prohibited event is stored for not more than 1 day.
    • A warning or an informational event is stored for not more than 1 day.
  • If notifications about the event are disabled or not available, its storage duration depends on the event origin:
    • An event from your user's device is not stored on the server.
    • An event from the server is stored according to the table below.

  Storage duration of server events

  Event description	Storage duration, not more than, days
  License expires soon.	90
  Malware outbreak.	180
  Audit: Group settings have been modified.	30
  Audit: Object has been modified.	30
  Audit: Connection to the Administration Server has been established.	30
  Audit: Object status has changed.	30
  Files have been found to send to Kaspersky for analysis.	30
  Certificate has expired.	180
  Certificate has been removed.	90
  Certificate has been requested.	90
  No free space in the Administration Server database.	180
  The Administration Server database is unavailable.	180
  No free disk space.	180
  License limit has been exceeded.	90
  Over 90 percent of the license key is used up.	30
  License limit has been exceeded.	180
  License expires soon.	180
  Limited functionality mode.	180
  Connection to the primary Administration Server has been established.	30
  Connection to the primary Administration Server has been interrupted.	90
  Connection to the secondary Administration Server has been established.	30
  Connection to the secondary Administration Server has been interrupted.	90
  New device has been detected.	0
  Device has remained inactive on the network for a long time.	90
  Device has been automatically moved according to a rule.	30
  Device has become unmanaged.	180
  Device status is Warning.	90
  Device has been removed from the group: inactive on the network for a long time.	30
  Limit of installations has been exceeded for one of the licensed applications groups.	180
  Limit of installations will soon be reached for one of the licensed applications groups.	90
  Limit of installations will soon be exceeded (more than 95 percent is used up) for one of the licensed applications groups.	30
  The key file has been added to the denylist.	180
  No free space in the Administration Server database.	90
  Little free space on the hard drive.	90
  Runtime error.	180
  New updates for Kaspersky software modules have been registered.	90
  Updates for Kaspersky software modules have been revoked.	180
  Shared folder is not available.	180
  Databases have been updated.	30
  Failed to copy the updates to the specified folder.	180
  Updates have been successfully copied to the specified folder.	30
  User has logged in.	90
  User has been added.	90
  User has been renamed.	90
  User details have been changed.	90
  User has been deleted.	90
  Group has been added.	90
  Group has been renamed.	90
  Group has been changed.	90
  Group has been deleted.	90
  User has been granted administrator privileges.	90
  User no longer has administrator privileges.	90
  User has been added to a group.	90
  User has been moved to another group.	90
  User has been removed from a group.	90
  Security profile has been added.	90
  Security profile has been renamed.	90
  Security profile has been changed.	90
  Security profile has been deleted.	90
  Operation with a file in Quarantine.	90
  Security profile has been changed.	90

Page top