Symantec 10521146 Administration Guide - Page 249

Managing log files 249 Configuring automatic archiving 6 In Apply Changes To, select the node to which to apply the parameter. 7 Click OK to save the changes to this node and close. Note: Restart Symantec Network Security for changes to this parameter to take effect. Note: For information about how to manage logs manually, see "About the Knowledge Base" on page 22. Archiving log files To conserve disk space and ensure optimal performance, the Network Security incident and event logs should be archived and compressed periodically. SuperUsers and Administrators can archive the logs based on file size, time, or both. To conserve space on the node, you can use Secure Copy Protocol (SCP) to move the archived logs to another host. Symantec Network Security automatically performs log archiving based on log size. SuperUsers and Administrators can control log archiving by editing the Size to Trigger Rotation parameter. Alternatively, you can configure Symantec Network Security to perform time-based log archiving. In either case, you must configure the Compression On/Off Switch if log compression is desired. Caution: Tune your log file archiving based on the amount of attack traffic your site experiences. If the log directory becomes full, logging and reporting of incident and event data to the Network Security console will be suspended. Monitor your disk space to ensure that there continues to be sufficient space for the logs. Use the following Log and Database Parameters to establish a static system that shrinks and grows without intervention: ■ Setting Size to Trigger Rotation ■ Setting Limit Size for Archive Directory ■ Setting Limit Size for Traffic Record Directory Setting Size to Trigger Rotation Size to Trigger Rotation determines the size at which the logs and database files are archived. Symantec Network Security checks the log and database sizes periodically, and archives them when they exceed this size.