The archiver tool archives and deletes a single day's worth of data at a time, to reduce the impact on the database. After you launch the archiver, it automatically processes data in batches which are configurable using the -b, -y and -z options in the Archiver Command Reference.
Both the moogsoft-db and moogsoft-utils packages include the archiver tool. You can find it at:
See the Archiver Command Reference for a full list of available arguments.
- We recommend running the archiver tool outside core operational hours to minimize the impact to users. Users of the interface should refresh their sessions after the utility has been used to delete data.
- Archiving often in small quantities allows for fast execution and minimal impact.
- You can set up a cron job to run the archiver daily, outside core operational hours.
- You can use a specific alert or Situation filter to remove targeted events.
- Exporting and/or removing large amounts of data on a running system can be slow.
- Exporting from a remote machine is slower because of network latency.
- The archiver tool can export data from the prc_earliest_highest_severity_event table but it cannot delete this data.
- To run the archiver tool remotely from Elasticsearch, follow the instructions in the Distributed Installation section of the Implementor Guide to configure Elasticsearch to listen on the external interface.
- You do not need to re-run the indexer after using the archiver tool to delete data. The -r option deletes records from Elasticsearch to keep the search feature synchronized with the database.