FortiSIEM
FortiSIEM provides Security Information and Event Management (SIEM) and User and Entity Behavior Analytics (UEBA)
nsoni
Staff
Staff
Article Id 214337
Description This article describes details on FortiSIEM CLI tool that can be used to purge events for an organization.
Scope FortiSIEM.
Solution

TestDBPurger CLI Tool can be used to purge logs for an organization. This tool should be run as admin. Below are the usage details for the same.

 

Usage: TestDBPurger EventDB DEST MODE CUSTID DATES.


Description: Purge an organization's data from EventDB for days specified in DATES.

 

Mandatory argumentsEventDB - Event DB directory, such as /data/eventdb.


DEST - Directory for keeping output data.


MODE - Control where to put processed (purged) data.
0 Output the processed DB to destDir. It is possinle to copy it back to eventDB manually.
1 Output the processed DB to eventDB to make it effect for query. Move original data to destDir.


CUSTID: CustId for the organization to be purged.


DATES: Comma separated list of dates or date-range to process.
A date is specified as the number of days since the UNIX epoch, 1970-01-01.

A date-range is range specified by two dates inclusively separated by '-'.

Use the below Linux command to generate a epoch date (replace MM/DD/YYYY with actual date):

 

echo $(($(date --utc --date="MM/DD/YYYY" +%s)/86400))

 

TestDBPurger Example: TestDBPurger /data/eventdb /tmp/eventdb 1 2000 16230,16233-16235.


Purge data on 6/8/2014 and from 6/11/2014 to 6/13/2014 of organization 2000 and then restore the purged data back to eventdb.

 

Note the following before using the tool:

 

- Confirm the Organization ID before executing the tool.

 

- It is recommended to run this tool only for a single date at a time and not for the entire date range at once.

 

- Make sure enough space is available for Directory for keeping output data (/tmp/eventdb as per above example) which is actually backup of events and can be deleted later if not needed.

Contributors