> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/knowledge-base/english/siem/how-can-i-adjust-the-retention-period-for-my-log-backups-in-the-enginsight-siem.md).

# How can I adjust the retention period for my log backups in the Enginsight SIEM?

You can configure the retention period (Time to Live; TTL) for log backups in the Enginsight Loggernaut component separately for each organization you manage.

{% hint style="success" icon="lightbulb" %}
For more information on how to adjust the **retention periods of logs in Apache Solr**, see the Knowledge Base: [How can I adjust the retention periods for my Enginsight logs?](/docs/knowledge-base/english/logging/how-can-i-adjust-the-retention-periods-for-my-enginsight-logs.md)
{% endhint %}

Follow these steps:

{% stepper %}
{% step %}

### Open the Loggernaut configuration file

1. Log in to the **SIEM Management Server** or to the dedicated server on which you installed the Enginsight SIEM component Loggernaut.
2. Open the **Loggernaut configuration file** using the following command:

```
sudo nano /opt/enginsight/loggernaut/config.json
```

3. Navigate to the `backup` section:

```
{    
    "api": {...},
    "siem": {...},
    ...,
    "backup": {
        "strategy": "",
        ...
        }
}
```

{% endstep %}

{% step %}

### Optional: Adjust the `strategy` parameter

Optionally adjust the `strategy` parameter. This parameter defines how Loggernaut handles backups.

Set the parameter as follows if you *are not configuring an external backup* and want raw logs to be deleted after the log TTL expires:

<pre><code>"backup": {
<strong>        "strategy": "remove",
</strong>        ...
        }
</code></pre>

{% hint style="success" icon="lightbulb" %}
For more information on how to create an *external backup*, see the Knowledge Base: [How can I create an external backup of my raw logs in the Enginsight SIEM?](/docs/knowledge-base/english/siem/how-can-i-create-an-external-backup-of-my-raw-logs-in-the-enginsight-siem.md)
{% endhint %}
{% endstep %}

{% step %}

### Add the `ttl` parameter

Now add and adjust the `ttl` parameter for [all organizations](#adjustment-for-all-organizations), for [single organizations](#adjustments-for-single-organizations), or for [all organizations with exceptions](#adjustments-for-all-organizations-with-exceptions-for-single-organizations).

#### Adjustments for all organizations

Add the highlighted parameters and values to the `backup` section:

<pre><code>"backup": {
    "strategy": "",
<strong>    "ttl": {
</strong><strong>      "*": &#x3C;TTLinDays>, 
</strong>    }
  }
</code></pre>

{% hint style="info" %}
Remember to replace `<TTLinDays>` with the period in days after which the log backups should be deleted automatically.
{% endhint %}

#### Adjustments for single organizations

Add the highlighted parameters and values to the `backup` section:

<pre><code>"backup": {
    "strategy": "",
<strong>    "ttl": {
</strong><strong>      "&#x3C;OrganizationID1>": &#x3C;TTLinDays>,
</strong><strong>      "&#x3C;OrganizationID2>": &#x3C;TTLinDays>, 
</strong>    }
  }
</code></pre>

{% hint style="info" %}
Remember to replace `<OrganizationID>` with the ID of the respective organization and `<TTLinDays>` with the period in days after which the log backups should be deleted automatically.
{% endhint %}

#### Adjustments for all organizations with exceptions for single organizations

{% hint style="warning" %}
**Please note**: TTLs for single organizations always overwrite the TTL for all organizations!
{% endhint %}

Add the highlighted parameters and values to the `backup` section:

<pre><code>"backup": {
    "strategy": "",
<strong>    "ttl": {
</strong><strong>      "*": &#x3C;TTLinDays>,
</strong><strong>      "&#x3C;OrganizationID1>": &#x3C;TTLinDays>,
</strong><strong>      "&#x3C;OrganizationID2>": &#x3C;TTLinDays>, 
</strong>    }
  }
</code></pre>

{% hint style="info" %}
Remember to replace `<OrganizationID>` with the ID of the respective organization and `<TTLinDays>` with the period in days after which the log backups should be deleted automatically.
{% endhint %}
{% endstep %}

{% step %}

### Save the configuration changes

Save the configuration file (**Ctrl** + **o**) and confirm the save process. Close the file (**Ctrl** + **x**).
{% endstep %}

{% step %}

### Restart Loggernaut

Restart Loggernaut using the following command to apply the changes:

```
sudo systemctl restart ngs-loggernaut
```

{% endstep %}
{% endstepper %}

***

## Further Resources

**Knowledge Base**

* [How can I adjust the retention periods for my Enginsight logs?](/docs/knowledge-base/english/logging/how-can-i-adjust-the-retention-periods-for-my-enginsight-logs.md)
* [How can I create an external backup of my raw logs in the Enginsight SIEM?](/docs/knowledge-base/english/siem/how-can-i-create-an-external-backup-of-my-raw-logs-in-the-enginsight-siem.md)

***