Fortinet white logo
Fortinet white logo

User Guide

Managing Events in EventDB

Managing Events in EventDB

TestDBPurger Tool

Description: This tool is used to delete data for a single date.

Usage: TestDBPurger {EVENTDB} {DEST} {MODE} {CUSTID} {DATES}

Argument

Description

EVENTDB

The eventDB directory, for example: /data/eventdb.

DEST

The directory to retain output data.

MODE

Control where to put processed (purged) data.

0 - Output the processed DB to destDir. It is possible to copy it back to eventDB manually.

1 - Output the processed DB to eventDB to make it effect for query. Move original data to destDir.

CUSTID

Customer ID for the organization to be purged.

DATES

Comma separated list of dates or date-range to process. A date is specified as the number of days since the UNIX epoch, 1970-01-01. A date-range is range specified by two dates inclusively separated by '-'. Use the following Linux command to generate a epoch date (Note: Replace MM/DD/YYYY with actual date):
echo $(($(date --utc --date="MM/DD/YYYY" +%s)/86400))

Notes:

  1. You should only use this script to delete data for a single date and organization. If you try to delete data for multiple dates, the script may fail.
  2. The script is located at /opt/phoenix/bin/TestDBPurger. Run it in terminal mode and follow the instructions.
  3. Should be run as admin user.
  4. Make sure enough space is available for the directory holding the output data (/tmp/eventdb in the example) which is actually a backup of events and can be deleted later if not needed.

Example:

TestDBPurger /data/eventdb /tmp/eventdb 1 2000 16230,16233-16235

EnforceRetentionPolicy Tool

Description: This tool can be used to enforce retention policy on dates earlier than the retention policy normally covers.

Usage: EnforceRetentionPolicy {DATES}

Argument

Description

DATES

Comma separated list of dates or date-range on which to enforce retention policy. DATES is specified as the number of days since the UNIX epoch began, 1970-01-01. A date-range can be specified by two dates inclusively separated by '-'. Use the following Linux command to generate a epoch date (Note: Replace MM/DD/YYYY with actual date):
echo $(($(date --utc --date="MM/DD/YYYY" +%s)/86400))

Notes:

  1. Run the tool as admin user.

Example:

EnforceRetentionPolicy 16230,16233-16235

This example command enforces retention policies on these dates: 6/8/2014 and from 6/11/2014 to 6/13/2014.

TestSegmentReader Tool

Description: This tool is used to quickly read data segments in the eventDB through the command line. You can use this to manually inspect data integrity and parsed event attributes.

Usage: TestSegmentReader {segmentDir}

Argument

Description

segmentDir

The segment directory.

Notes:

  1. Run the tool as admin user.

Example:

TestSegmentReader /archive/CUSTOMER_3/default/17897/429628-423551-172384880/seg-1-0-300000-1545300800-1543305001/

Managing Events in EventDB

Managing Events in EventDB

TestDBPurger Tool

Description: This tool is used to delete data for a single date.

Usage: TestDBPurger {EVENTDB} {DEST} {MODE} {CUSTID} {DATES}

Argument

Description

EVENTDB

The eventDB directory, for example: /data/eventdb.

DEST

The directory to retain output data.

MODE

Control where to put processed (purged) data.

0 - Output the processed DB to destDir. It is possible to copy it back to eventDB manually.

1 - Output the processed DB to eventDB to make it effect for query. Move original data to destDir.

CUSTID

Customer ID for the organization to be purged.

DATES

Comma separated list of dates or date-range to process. A date is specified as the number of days since the UNIX epoch, 1970-01-01. A date-range is range specified by two dates inclusively separated by '-'. Use the following Linux command to generate a epoch date (Note: Replace MM/DD/YYYY with actual date):
echo $(($(date --utc --date="MM/DD/YYYY" +%s)/86400))

Notes:

  1. You should only use this script to delete data for a single date and organization. If you try to delete data for multiple dates, the script may fail.
  2. The script is located at /opt/phoenix/bin/TestDBPurger. Run it in terminal mode and follow the instructions.
  3. Should be run as admin user.
  4. Make sure enough space is available for the directory holding the output data (/tmp/eventdb in the example) which is actually a backup of events and can be deleted later if not needed.

Example:

TestDBPurger /data/eventdb /tmp/eventdb 1 2000 16230,16233-16235

EnforceRetentionPolicy Tool

Description: This tool can be used to enforce retention policy on dates earlier than the retention policy normally covers.

Usage: EnforceRetentionPolicy {DATES}

Argument

Description

DATES

Comma separated list of dates or date-range on which to enforce retention policy. DATES is specified as the number of days since the UNIX epoch began, 1970-01-01. A date-range can be specified by two dates inclusively separated by '-'. Use the following Linux command to generate a epoch date (Note: Replace MM/DD/YYYY with actual date):
echo $(($(date --utc --date="MM/DD/YYYY" +%s)/86400))

Notes:

  1. Run the tool as admin user.

Example:

EnforceRetentionPolicy 16230,16233-16235

This example command enforces retention policies on these dates: 6/8/2014 and from 6/11/2014 to 6/13/2014.

TestSegmentReader Tool

Description: This tool is used to quickly read data segments in the eventDB through the command line. You can use this to manually inspect data integrity and parsed event attributes.

Usage: TestSegmentReader {segmentDir}

Argument

Description

segmentDir

The segment directory.

Notes:

  1. Run the tool as admin user.

Example:

TestSegmentReader /archive/CUSTOMER_3/default/17897/429628-423551-172384880/seg-1-0-300000-1545300800-1543305001/