Data Retention

This page reviews Data Retention for GroundWork Monitor.

Deleting Event Messages and Report Entries, and Cleaning Log Files

Maintaining the Foundation Database (GWCollageDB)
Maintaining the Insight Reports Database (dashboard)
Log Rotation

Deleting Event Messages and Report Entries, and Cleaning Log Files

Maintaining the Foundation Database (GWCollageDB)

Selectively Delete Event Messages from the Foundation Database

To selectively delete event messages from the GWCollageDB database that are older then a certain date, use the following procedure.

Open a terminal session and login as: root
Make sure no one is logged into the system by stopping gwservices with the following command:
```
/usr/local/groundwork/ctlscript.sh stop gwservices
```
Open the PostgreSQL console with the following command:
```
psql -u root -p
```
Enter the following command:
```
use \c gwcollagedb
```
Delete specific event messages by entering the following command with specified dates.
This will delete event messages before January 1, 2009.
```
delete from LogMessage where ReportDate < '2009-01-01 00:00:00';
```
Enter:
```
exit
```

Restart gwservices with the following command:

/usr/local/groundwork/ctlscript.sh start gwservices

Maintaining the Insight Reports Database (dashboard)

Selectively Delete Report Entries from the Insight Reports Database

To selectively delete report entries from the dashboard database that are older then a certain date, use the following procedure.

Open a terminal session and login as: root
Make sure no one is logged into the system by stopping gwservices with the command:
```
/usr/local/groundwork/ctlscript.sh stop gwservices
```
Stopping httpd with the command:
```
/usr/local/groundwork/ctlscript.sh stop apache
```
Open the PostgreSQL console with the following command:
```
psql -u root -p
```
Enter the following command:
```
use \c dashboard
```
Delete specific report entries by entering the following commands with specified dates.
This will delete daily alert entries before January 1, 2009.
```
delete from measurements where TIMESTAMP < '2009-01-01';
```
This will delete daily host availability entries before January 1, 2009.
```
delete from host_availability where DATESTAMP < '2009-01-01'
```
This will delete daily service availability before January 1, 2009.
```
delete from service_availability where DATESTAMP < '2009-01-01'
```
This will delete host group availability entries before January 1, 2009.
```
delete from hostgroup_host_availability where DATESTAMP < '2009-01-01'
```
This will delete daily service availability entries before January 1, 2009.
```
delete from hostgroup_service_availability where DATESTAMP < '2009-01-01'
```
Enter:
```
exit
```

Restart gwservices with the following command:

/usr/local/groundwork/ctlscript.sh start gwservices

Restart httpd with the following command:

/usr/local/groundwork/ctlscript.sh start apache

Log Rotation

The packages that comprise GroundWork Monitor will generate log files in several places on the disk. This is by design, and is useful in many cases to find out what is happening with the data that the packages gather and store. Nagios, for example will use its log files for the default reports it generates.

The down side is that log file take up space, and so there are several settings needed for the Linux utility program known as logrotate to clean up these files periodically.

GroundWork has adjusted these settings according to parameters that will work in most cases. Sometimes, however, it will be necessary to add or remove logs from rotation. For example, if a package is added, and it generates log files, these should be rotated to avoid filling the disk.

Log Rotate Settings

All the settings specific to GroundWork can be found in the file:

/etc/logrotate.d/groundwork

This file is created when GroundWork Monitor is installed, and is removed on un-install. This file may be edited to adjust the settings as necessary, however, when adjusting logrotate settings, be sure to test them with the following command using user root:

logrotate -d /etc/logrotate.d/

Log Files Rotated by Default

The following log files are rotated by default at the interval of once a day, with old files saved for 8 days:

/usr/local/groundwork/apache2/logs/access_log
/usr/local/groundwork/apache2/logs/error_log
/usr/local/groundwork/core/services/foundation/log/main
/usr/local/groundwork/foundation/container/logs/nagios2collage_hostgroupcheck.log

Other Files

The following files may or may not exist, depending on user settings. They will be rotated once a day, with old files saved for 8 days, if they do exist:

/usr/local/groundwork/nagios/eventhandlers/process_service_perf.log
/usr/local/groundwork/common/var/log/snmp/snmptt.debug
/usr/local/groundwork/common/var/log/snmp/snmptrapd.log
/usr/local/groundwork/common/var/log/syslog-ng/ (all files)

The following files may be accidentally created, due to default settings in the Nagios tool. These settings are off by default in GroundWork's implementation of Nagios, but they would grow without bound if turned on, and that can fill the disk. Users should be aware that these files will be rotated by default every day, and that only one day's worth of old files will be kept.

/usr/local/groundwork/nagios/var/host-perfdata.dat
/usr/local/groundwork/nagios/var/service-perfdata.dat

Nagios Log Files

Finally, the Nagios log files are archived by Nagios, but are never deleted. These files are useful for reporting purposes within the Nagios system (Nagios Reports). They can be large, however, especially if the default logging is changed in the Nagios tool to log more information, such as state stalking. Thus GroundWork settings will remove old log files after a month. The old Nagios log files are located in:

/usr/local/groundwork/nagios/var/archives