Archive and retrieve

This topic describes the FortiDB archiving and retrieving process and gives some guidelines for its use.

Assessment and monitoring/auditing data in the FortiDB repository can be moved to archive files in order to conserve repository space and improve performance. You should periodically archive data if you enable the DAM activity auditing or compliance audit with alert PCI and SOX policies.

There are three types of dataset archived and restore.

Assessment data
Alert data
Auditing data including sniffer activity auditing data, and SOX audit data generated by alert SOX policy.

Archiving data exports it to a file. Retrieving data imports it into the FortiDB repository.

FortiDB archives are stored within encrypted files. Depending upon your assessment or monitoring frequency and upon the number and type of policies and target databases involved, the files can consume a large amount of space. To free space on your appliance, move the exported files to remote storage where you can restore them later if necessary.

Note:

If you want to report on archived data, you must retrieve it first.

If you delete a completed assessment's configuration settings after archiving, that information cannot be retrieved. For example, if you delete a target database connection after archiving its assessment information, that information cannot be restored.

The entry in the Timestamp column on Retrieve tab represents the day and time that the archive was performed.

Once retrieved and in order to prevent duplicate records in the FortiDB repository, any records already in the FortiDB repository will not be retrieved again during the restore process.