0 Replies Latest reply on May 13, 2015 7:29 AM by streamer

    How I manage of ESM Disk Capacity?

    streamer

      Hi,

       

      I have a McAfee ESM x4 and it has 13TB total disk capacity. We have been collecting only EventData about 8 month and last status as below:

       

      Total Event Count: 6.756.256.322

      Date of first event : 01.11.2014

      Date of last event: current day

       

      McAfee-ETM-X4 ~ # df -h

      Filesystem            Size  Used Avail Use% Mounted on

      /dev/sda3             1.9T   15G  1.8T   1% /

      /dev/sda1             975M   62M  864M   7% /boot

      /dev/sdb1              13T   11T  2.6T  81% /data_hd

      shm                    48G     0   48G   0% /dev/shm

      /dev/md0              743G  542G  455G  73% /index_hd

       

      I was deleting one billion eventlog for to save disk space, yesterday. However, after delete process, only reduces the size on the index_hd ! But I was excepting reduce in the /data_hd,as well! Last status as below:

       

      Last Total Event Count: 5.754.254.323

       

      McAfee-ETM-X4 ~ # df -h

      Filesystem            Size  Used Avail Use% Mounted on

      /dev/sda3             1.9T   16G  1.8T   1% /

      /dev/sda1             975M   62M  864M   7% /boot

      /dev/sdb1              13T   11T  2.6T  81% /data_hd            // Why didn't reduce size of /data_hd?

      shm                    48G     0   48G   0% /dev/shm

      /dev/md0              743G  410G  334G  56% /index_hd   //This is just reduced after the deleting 1 billion event data

       

      Thank for your reply.