Can Someone Explain "Keep Log Files For An Extra..." Setting in R80.40 Management?

[Daniel_Taney]

As the subject states, I was hoping someone might be able to give me a little deeper insight into exactly what this setting controls. 

Is it safe to assume this refers to the flat log files that reside under $FWDIR/log on the log server? Since this particular server is intended for Management and short-term log storage, my goal was to only keep a week's worth of log files and indexes on this VM. If logs were needed beyond the 1 week period, I have a separate log server with a longer retention policy. 

So, with that goal in mind... if I only want 1 week's worth of logs, should I change this setting to "1 day" taking it to mean the log files would be kept for 1 day longer than the Indexes? Or would this need to be set to "8 days" to imply they should begin to roll off after the 7 day period. 

Hopefully that makes sense? 

Thanks!

Dan

[Martin_Valenta · Accepted solution]

https://sc1.checkpoint.com/documents/R80.40/WebAdminGuides/EN/CP_R80.40_LoggingAndMonitoring_AdminGu... just google

[Daniel_Taney]

TBH, I didn't bother looking in the Admin Guide, because all this detail doesn't come up with you look at the online help in SmartConsole for that screen. So, I just (wrongly) assumed the Admin Guide also wouldn't mention the field. Regardless, thanks for pointing this out and it does appear that the setting behaves as I assumed it would.

[Shay_Hibah · Accepted solution]

Hey Daniel,
How are you?

I will give you the correct answer 🙂
When you set "keep logs for an extra.." to 1 it means that raw logs will be saved for an additional 1 day compared to indexes ("keep indexed logs").
Meaning that if you want to save indexes for no longer than 7 days and log files for 8 days, you need to set the first box to 7 and the second to 1.

Please let me know if you need any additional assistance,
Shay

[Daniel_Taney]

Thank you! This is the exact answer I was hoping for!