Currently we have only 9 months data in ESM. As checked, still we have more storage space available.
How can we increase the ESM Data retention limit.
Current ESM storage status
HDD - sdb3 Size: 1.9TB, Used: 21GB( 2%), Available: 1.7TB, Mount: /
HDD - sda Size: 445GB, Used: 268GB(61%), Available: 178GB, Mount: /index_hd
HDD - sdc1 Size: 7.3TB, Used: 5.3TB(73%), Available: 2.0TB, Mount: /data_hd
Also, just below that is the Data Allocation setting. By default, the database has some reserved record space for netflow.
If you're not bringing any netflow data in, you can increase the number count for events. This does create a rebuild and should be performed during maintenance.