Technical Tip: Accelops: How to purge, delete, remove, truncate events older than 'x' days

[Anonymous]

Description

This article describes the process of purging events older than X days. This applies only to the event database.

Scope

FortiSIEM.

Solution

1. Copy the attached purgeData.py script to the /tmp directory.
2. SSH to the accelops server.
3. Run 'su - admin'.
4. Run 'cd /tmp'.
5. Run 'python purgeData.py X'.
   
   

Additional Information:

Where X means to purge all the events before the most recent X days. For example, if having 300 days of data and using 200 as a parameter, the script purges the oldest 100 days of events.

Once copied to the /tmp directory, it may be necessary to run dos2unix on the file to convert it to Linux format.

dos2unix purgeData.py

Version Application:

All.