Setting Limits for Event Deletion

You can set limits to delete data to keep the Carbon Black App Control Server database at a reasonable size.

The Carbon Black App Control Server provides several mechanisms for handling the volume of data. Carbon Black App Control provides for automatic deletion of event data based on two parameters:

• Delete Events Older Than – By default, events older than four (4) weeks are automatically deleted, which means that event data is purged on the system and is not available for display in reports that the Carbon Black App Control Server generates. You can modify the time period in the Management Configuration table.
• Delete if More Than – This threshold defaults to one (1) million for SQL Server Express, and ten (10) million for other SQL Server editions. This parameter works with a second parameter: On Limit Delete Oldest, which allows you to define the percentage of the events that are deleted when you reach the defined limit. The default percentage is 10%.

Event data is deleted when either condition is met. You can configure these automatic deletion parameters based the available disk space on the SQL Server and your need for historical information. To determine the appropriate values for your network, monitor disk space use on the server and adjust the event database deletion parameters accordingly.