I am trying to get my head around how to effectively set up backup and archiving the ESM database,
If I have set up the ESM to archive events and flows, It will eventually write out data to an archive partition. Can I store the contents of the partition offline somewhere, and be able to restore it if necessary, or does it need to always be available to the ESM?
If a retention time is set under Database/Data Retention, is data rolled into a partition when either data reaches that age or the local storage fills (whichever happens first), or is it that if the storage fills before the data reaches retention age, that older events are dropped from the database?
1. You can store the content on iSCASI or a SAN but not offline.
If click on Database | Data Allocation there is a message "Configure how much space the database should allocate for Events and Flows by specifying the number of records for each table. The total size is a fixed value. These settings may affect the data retention policy."