> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/knowledge-base/english/logging/how-can-i-adjust-the-retention-periods-for-my-enginsight-logs.md).

# How can I adjust the retention periods for my Enginsight logs?

In Enginsight, you can customize the default retention periods (Time-to-Live; TTL) for specific logs. In the following, we will show you how to do this.

***

## Default Retention Periods

Enginsight logs have different default retention periods:.

### Storage in the Enginsight Database

<table><thead><tr><th width="276.12890625">Log</th><th>Index Name (Configuration)</th><th width="129.2734375">Retention Period (Days)</th><th width="135.421875">Retention Period (Seconds)</th></tr></thead><tbody><tr><td>Audits (Penetration Tests)</td><td>pentestAudits</td><td>90</td><td>7776000</td></tr><tr><td>User Activities</td><td>history</td><td>180</td><td>15552000</td></tr><tr><td>File Integrity Monitoring / FIM (Hosts)</td><td>hostFimLogs</td><td>1</td><td>8640</td></tr><tr><td>Metrics (Hosts)</td><td>hostMetrics</td><td>14</td><td>1209600</td></tr><tr><td>Metrics (Endpoints)</td><td>endpointWebsites</td><td>14</td><td>1209600</td></tr><tr><td>Network Anomalies (Hosts)</td><td>hostNetworkAttacks</td><td>3</td><td>259200</td></tr><tr><td>Reports / PDFs</td><td>reportsPDFs</td><td>365</td><td>31536000</td></tr><tr><td>Shield (Hosts)</td><td>shieldLogs</td><td>30</td><td>2592000</td></tr><tr><td>Exports (SIEM)</td><td>siemExports</td><td>30</td><td>2592000</td></tr><tr><td>Incidents (SIEM)</td><td>siemIncidents</td><td>90</td><td>7776000</td></tr><tr><td>System Events (Hosts)</td><td>hostEvents</td><td>3</td><td>259200</td></tr></tbody></table>

### Storage on the SIEM Index Server

The default retention period for logs on the SIEM Index Server, more specifically, in Apache Solr, is 30 days for all organizations.

***

## Adjusting Retention Periods (Without SIEM Index Server)

All default retention periods **except for the retention period on the SIEM index Server** can be adjusted in the **Enginsight configuration file**. Follow these steps:

{% stepper %}
{% step %}

### Open the configuration file

1. Log in to the **Enginsight Application Server**.
2. Open the Enginsight configuration file using the following command:

```
sudo nano /opt/enginsight/enterprise/conf/services/config.json
```

{% endstep %}

{% step %}

### Extend the database section or adjust existing values

1. In the configuration file, navigate to the following section:

```
"database": {
    "uriConnectionString": "%%MONGODB_URI%%"
  },
```

2. Extend the database section as follows and/or adjust any TTLs that have already been set.

{% hint style="warning" %}
**Please note**: The retention period, or TTL, is specified **in seconds**. Also make sure that you use **valid JSON**.
{% endhint %}

```
 "database": {
    "uriConnectionString": "%%MONGODB_URI%%",
    "indexes": {
      "siemIncidents": {
        "ttl": 7776000
      },
      "siemExports": {
        "ttl": 2592000
      },
      "shieldLogs": {
        "ttl": 2592000
      },
      "hostFimLogs": {
        "ttl": 86400
      },
      "pentestAudits": {
        "ttl": 7776000
      },
      "endpointWebsites": {
        "ttl": 1209600
      },
      "hostMetrics": {
        "ttl": 1209600
      },
      "hostEvents": {
        "ttl": 259200
      },
      "hostNetworkAttacks": {
        "ttl": 259200
      },
      "history": {
        "ttl": 15552000
      },
      "reportsPDFs": {
        "ttl": 31536000
      }

    }
  },
```

3. Save the changes to the configuration file (**Ctrl** + **o**) and confirm the save process. Close the file (**Ctrl** + **x**).
   {% endstep %}

{% step %}

### Optional: Validate the JSON

When making your changes, make sure that the JSON format is correct. If you are unsure, use a JSON validation tool to check whether the adjusted configuration file complies with JSON syntax requirements.
{% endstep %}

{% step %}

### Apply the changes on the Application Server

You now need to run the setup script for the Application Server again to apply the configuration changes.

1. Navigate to the Enginsight installation directory using the following command:

```
cd /opt/enginsight/enterprise
```

2. Run the setup script anew using the following command and confirm all prompts with the **Enter** key:

```
sudo ./setup.sh
```

{% endstep %}
{% endstepper %}

***

## Adjusting Retention Periods on the SIEM Index Server

The log retention periods on the SIEM Index Server or, more specifically, in **Apache Solr**, can be adjusted in the **configuration file of the SIEM component Loggernaut**.

{% hint style="success" icon="lightbulb" %}
For more information on how to adjust the retention periods of your log backups in the SIEM, see the Knowledge Base: [How can I adjust the retention period for my log backups in the Enginsight SIEM?](/docs/knowledge-base/english/siem/how-can-i-adjust-the-retention-period-for-my-log-backups-in-the-enginsight-siem.md)
{% endhint %}

Follow these steps:

{% stepper %}
{% step %}

### Open the Loggernaut configuration file

1. Log in to the **SIEM Management Server** or to the dedicated server on which you installed the Enginsight SIEM component Loggernaut.
2. Open the **Loggernaut configuration file** using the following command:

```
sudo nano /opt/enginsight/loggernaut/config.json
```

{% endstep %}

{% step %}

### Add and adjust the `ttl` parameter

1. Add the `ttl` section to the configuration file if it does not exist yet:

<pre><code>"api": {
    ...
},
"siem": {
    ...
},
<strong>"ttl": {
</strong><strong>    ...
</strong><strong>},
</strong></code></pre>

2. Now adjust the `ttl` parameter for [all organizations](#adjustment-for-all-organizations), for [single organizations](#adjustments-for-single-organizations), or for [all organizations with exceptions](#adjustments-for-all-organizations-with-exceptions-for-single-organizations).

#### Adjustments for all organizations

Adjust the retention period for all organizations as follows:

<pre><code>"ttl": {
<strong>      "*": &#x3C;TTLinDays>, 
</strong>},
</code></pre>

{% hint style="info" %}
Remember to replace `<TTLinDays>` with the period in days after which the logs should be deleted automatically.
{% endhint %}

#### Adjustments for single organizations

Adjust the retention period for single organizations as follows:

<pre><code>"ttl": {
<strong>      "&#x3C;OrganisationID1>": &#x3C;TTLinDays>,
</strong><strong>      "&#x3C;OrganisationID2>": &#x3C;TTLinDays>, 
</strong>},
</code></pre>

{% hint style="info" %}
Remember to replace `<OrganizationID>` with the ID of the respective organization and `<TTLinDays>` with the period in days after which the logs should be deleted automatically.
{% endhint %}

#### Adjustments for all organizations with exceptions for single organizations

{% hint style="warning" %}
**Please note**: TTLs for single organizations always overwrite the TTL for all organizations!
{% endhint %}

Adjust the retention period for all organizations with exceptions for single organizations as follows:

<pre><code>"ttl": {
<strong>      "*": &#x3C;TTLinDays>,
</strong><strong>      "&#x3C;OrganisationID1>": &#x3C;TTLinDays>,
</strong><strong>      "&#x3C;OrganisationID2>": &#x3C;TTLinDays>, 
</strong> },
</code></pre>

{% hint style="info" %}
Remember to replace `<OrganizationID>` with the ID of the respective organization and `<TTLinDays>` with the period in days after which the logs should be deleted automatically.
{% endhint %}
{% endstep %}

{% step %}

### Save the configuration changes

Save the configuration file (**Ctrl** + **o**) and confirm the save process. Close the file (**Ctrl** + **x**).
{% endstep %}

{% step %}

### Restart Loggernaut

Restart Loggernaut using the following command to apply the changes:

```
sudo systemctl restart ngs-loggernaut
```

{% endstep %}
{% endstepper %}

***

## Further Resources

**Knowledge Base**

* [How can I adjust the retention period for my log backups in the Enginsight SIEM?](/docs/knowledge-base/english/siem/how-can-i-adjust-the-retention-period-for-my-log-backups-in-the-enginsight-siem.md)

***