Description | This article describes details on FortiSIEM CLI tool that can be used to purge events for an organization. |
Scope | FortiSIEM. |
Solution |
TestDBPurger CLI Tool can be used to purge logs for an organization. This tool should be run as admin. Below are the usage details for the same.
Usage: TestDBPurger EventDB DEST MODE CUSTID DATES.
Mandatory arguments: EventDB - Event DB directory, such as /data/eventdb.
A date-range is range specified by two dates inclusively separated by '-'. Use the below Linux command to generate a epoch date (replace MM/DD/YYYY with actual date):
echo $(($(date --utc --date="MM/DD/YYYY" +%s)/86400))
TestDBPurger Example: TestDBPurger /data/eventdb /tmp/eventdb 1 2000 16230,16233-16235.
Note the following before using the tool:
- Confirm the Organization ID before executing the tool.
- It is recommended to run this tool only for a single date at a time and not for the entire date range at once.
- Make sure enough space is available for Directory for keeping output data (/tmp/eventdb as per above example) which is actually backup of events and can be deleted later if not needed. |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.