Setting the storage term for an event

Kaspersky Security Center Linux allows you to receive information about events that occur during the operation of Administration Server and Kaspersky applications installed on managed devices. Information about events is saved in the Administration Server database. You might need to store some events for a longer or shorter period than specified by default values. You can change the default settings of the storage term for an event.

If you are not interested in storing some events in the database of Administration Server, you can disable the appropriate setting in the Administration Server policy and Kaspersky application policy, or in the Administration Server properties (only for Administration Server events). This will reduce the number of event types in the database.

The longer the storage term for an event, the faster the database reaches its maximum capacity. However, a longer storage term for an event lets you perform monitoring and reporting tasks for a longer period.

To set the storage term for an event in the database of Administration Server:

1. In the main menu, go to Assets (Devices) → Policies & profiles.
2. Do one of the following:
   • To configure the storage term of the events of Network Agent or of a managed Kaspersky application, click the name of the corresponding policy.

     The policy properties page opens.

   • To configure Administration Server events, in the main menu, click the settings icon () next to the name of the required Administration Server.

     If you have a policy for the Administration Server, you can click the name of this policy instead.

     The Administration Server properties page (or the Administration Server policy properties page) opens.

3. Select the Event configuration tab.

   A list of event types related to the Critical section is displayed.

4. Select the Functional failure, Warning, or Info section.
5. In the list of event types in the right pane, click the link for the event whose storage term you want to change.

   In the Event registration section of the window that opens, the Store in the Administration Server database for (days) option is enabled.

6. In the edit box below this toggle button, enter the number of days to store the event.
7. If you do not want to store an event in the Administration Server database, disable the Store in the Administration Server database for (days) option.

   If you configure Administration Server events in Administration Server properties window and if event settings are locked in the Kaspersky Security Center Administration Server policy, you cannot redefine the storage term value for an event.

8. Click OK.

   The properties window of the policy is closed.

From now on, when Administration Server receives and stores the events of the selected type, they will have the changed storage term. Administration Server does not change the storage term of previously received events.

Page top