Created on 
    
	
		
		
		01-17-2025
	
		
		04:20 AM
	
	
	
	
	
	
	
	
	
	
	
	
	
	
  Edited on 
    
	
		
		
		08-01-2025
	
		
		01:54 AM
	
	
	
	
	
	
	
	
	
	
	
	
	
	
 By  
				
		 Jean-Philippe_P
		
			Jean-Philippe_P
		
		
		
		
		
		
		
		
	
			 
		
| Description | This article describes how to delete events in mass from the EventDB database to free up space and purge old and unnecessary data. | 
| Scope | FortiSIEM. | 
| Solution | To manually delete the outdated data from the event database, remove all files that are older than X days. 
 Before deleting anything, use this command to check what will be deleted: 
 
 For example, to remove all the data and events older than 150 days, run the following: 
 find /data/eventdb/ -type f -mtime +150 -name '*' -exec rm -rfv {} \; Note: This example illustrates the removal of data that is 150 days old. This number can be adjusted based on specific requirements. 
 
 For more information related to space purging, see the 'Retention Policies' documentation: | 
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2025 Fortinet, Inc. All Rights Reserved.