for how much time events are stored in the server?

[meshorer]

hello all!

is there a default time that events (containers/cases) are stored in the SOAR server to approach to?

and if so, can I change the time?

@phanTom 

Thank you in advance

[scelikok]

H, @meshorer,

Yes, rest/health endpoint shows db_data and status off all services.

https://docs.splunk.com/Documentation/SOARonprem/6.2.0/PlatformAPI/RESTInfo#.2Frest.2Fhealth 

But maybe it is better to monitor the system using an external script or something else. This will alert you even system stops.

[scelikok]

Hi @meshorer,

Since your events could not be written to db, service would stop. That is why you should monitor system health.

[meshorer]

hi @scelikok ,

understood, thank you.

I would love to hear from you how you recommend to monitor system health.

I thought of rest call "health" in a playbook to run every few minuets.

if you have another idea, please do tell 🙂

[scelikok · Accepted solution]

Hi @meshorer,

Splunk SOAR keeps event, containers, etc. on its database up to database size limit. You can delete them according to your retention needs.

Please see https://docs.splunk.com/Documentation/SOARonprem/6.2.0/Admin/DeleteContainers

[meshorer]

hi @scelikok 

so what happens when I reach the size limit in my server?