Technical Tip: How to purge events for an organization from CLI
| Description | This article describes details on FortiSIEM CLI tool that can be used to purge events for an organization. |
| Scope | FortiSIEM. |
| Solution | TestDBPurger CLI Tool can be used to purge logs for an organization. This tool should be run as admin. Below are the usage details for the same.
Usage: TestDBPurger EventDB DEST MODE CUSTID DATES.
Mandatory arguments: EventDB - Event DB directory, such as /data/eventdb.
A date-range is range specified by two dates inclusively separated by '-'. Use the below Linux command to generate a epoch date (replace MM/DD/YYYY with actual date):
echo $(($(date --utc --date="MM/DD/YYYY" +%s)/86400))
TestDBPurger Example: TestDBPurger /data/eventdb /tmp/eventdb 1 2000 16230,16233-16235.
Note the following before using the tool:
- Confirm the Organization ID before executing the tool.
- It is recommended to run this tool only for a single date at a time and not for the entire date range at once.
- Make sure enough space is available for Directory for keeping output data (/tmp/eventdb as per above example) which is actually backup of events and can be deleted later if not needed. |