Activity Log Retention

[Snafu]

Our auditors have indicated we should be keeping 24 month's worth of Backup Logs.

What affect will increasing the Activity Log retention to 730 day have on the database, or is there a better way to retain the the data.

Thanks

 

[moon-buddy]

Nope - that's it.

 

[domino]

You can run a weekly (or monthly) script ... to export the actlog records to a textfile

 

[Snafu]

Thanks, but will there be any negative effects for the TSM database? Also, how do I go back changing the retention period?

 

[moon-buddy]

You can run a weekly (or monthly) script ... to export the actlog records to a textfile

Being a Security and Audit Professional myself, this option is not an answer. The requirement is to keep the Actlog in the system for two years. Thus, when the audit comes, you must be able to show that the Actlog can be extracted from the system.

This is a matter of Compliance and not just having the Actlog available.

Snafu will just have to bear the increase in DB size to accommodate the long retention requirement for the Actlog

 

[domino]

Yes, You are right

 

[tsmdumber]

My database size is 110 GB and actlog retention is 100 days and my q sta says Activity Log Size: 137 M.

Roughly calculatiing if i chnage the retention to 730 days, the db would increase by 10 GB only for actlog retnetion in the next 2 years!!!

I would really hate that and the auditor ofcourse

 

[Snafu]

Thanks Folks. I've increased my retention to 730 Days.

 

[Jeff_Jeske]

Is there an external legal reason to keep the ACT log that long? I work for an insurance company and we haven't been directed to retain our logs for any particular amount of time. We keep 30 days worth in the DB and that's it.

 

[moon-buddy]

Is there an external legal reason to keep the ACT log that long? I work for an insurance company and we haven't been directed to retain our logs for any particular amount of time. We keep 30 days worth in the DB and that's it.

Sometimes it not a matter of a legal reason.

The truth of the matter is that Risk and Compliance sees things differently than Technical people. Audit might have seen an 'anomaly' on how data is being backed up and restored, how fees are collected (in the case of Service providers), how data is aged and disposed of, etc.

If the organization is in the Medical field, this will be HIPAA driven; and for Financial organizations, SOX driven