Configuration

    Configure Data Archival settings

    Data Archival page overview

    • Log in to the ADAudit Plus web console.
    • Navigate to Admin tab → Integrations & Data Management → Data Archival.

    The Data Archival page shows:

    Area Description
    Hot / Cold / Frozen summary chart A donut chart showing the total current size of data in each state across all categories
    Last Run Time Timestamp of the most recent archival job run
    Time Interval The daily schedule time for the archival job (editable via the pencil icon)
    Status Result of the last archival run (Success or a failure indicator)
    Run Now Triggers an immediate archival run instead of waiting for the next scheduled time
    Archive Folder (top right) Opens the archive storage location setting — see details
    Recovery settings (top right) Opens the recovery window setting — see details
    Deletion Summary (above the table) Opens deletion history and schedule — see details
    Category table One row per report category, with Hot/Cold/Frozen size and retention settings — see columns below

    Category table columns:

    Column Description
    Actions Enable/disable archiving for the category (green check = enabled, red icon = disabled), and a gear icon to open its archive settings
    Categories Report category name, suffixed with its storage engine (for example, AD Replication- DataEngine)
    Hot Data Size / Hot Data Retention Current size of Hot-state data for the category, and its configured Hot Data Retention Time
    Reclaimable Space Disk space that would be freed if the category's aged-out data were archived immediately
    Cold Data Size / Cold Data Retention Current size of Cold-state data, and its configured Cold Data Retention Time (- if Cold state is not enabled or not applicable — see details)
    Frozen Data Size / Frozen Data Retention Current size of Frozen-state data, and its retention setting (shows Retained when configured to retain indefinitely)

    Note Every report category shown on this page is DataEngine-backed. If a category shows - under Cold Data Retention while Frozen Data Retention shows Retained, this means Cold state is simply not enabled for that category yet (see details) — not that the category is ineligible.

    Configure the archive folder location

    • On the Data Archival page, click Archive Folder (top right).
    • Specify the location where you want to store archive files.

    Note You can save archive files to a different drive or folder than the installation folder, or to a file server share. The storage path format differs based on the location:

    Location Path Format Example
    Default <ADAudit Plus Installation Folder>\archive C:\ManageEngine\ADAudit Plus\archive
    Different local drive {Drive}:\{Folder}\archive D:\Auditing\archive
    File server share \\{fileservername}\{sharename}\archive \\fileserver01\auditing\archive

    ⚠️ Important Verify sufficient free space is available at the chosen location before changing it — archive file volume grows with your retention configuration.

    ⚠️ Important If you change the archive location to a different local drive or a remote file server share, the ADAudit Plus Service Account must have NTFS Read & Write permission on the folder (and share Full Control if remote) — see Archive location access permissions.

    Configure archive settings for a report category

    • On the Data Archival page, under the Actions column, click Enable next to the report category you want to archive, then click the gear icon.
    • In the Archive settings pop-up, under Live Tier, specify the Hot Data Retention Time in days, months, or years.

    Note For retention calculations, each month is treated as 31 days and each year as 366 days.

    Cold state configuration *(available only for DataEngine categories)*:

    • To keep Cold state disabled: Skip to Frozen state configuration below.
    • To enable Cold state:
    • Click Enable.
    • Specify the Cold Data Retention Time in days, months, or years. Data will be archived in the Cold state for this period, then transition to Frozen.
    • Proceed to Frozen state configuration.

    Tip Enable the Cold state for report categories that require faster restoration from the archive.

    Frozen state configuration:

    • To retain archived data in Frozen state forever:
    • Ensure the Retain data indefinitely checkbox (under Frozen Data Retention) is checked.
    • Review the Summary section to understand how your data will age, then click Save.
    • To permanently delete archived data from the Frozen state after a period:
    • Uncheck Retain data indefinitely and specify the Frozen Data Retention Time in days, months, or years. Data will be permanently deleted after this period elapses.
    • Review the Summary section, then check the Agreement checkbox.
    • On the confirmation pop-up, click Confirm Delete, then click Save.

    ⚠️ Important Once the Frozen Data Retention Time elapses for a category configured without Retain data indefinitely, the archived data for that category is permanently deleted and cannot be recovered beyond the configured recovery window (see details). Confirm your compliance retention requirements before disabling indefinite retention.

    You have now enabled archiving for the selected report category. The configured settings appear in the table on the Data Archival page.

    Configure the recovery window

    Recovery settings let you configure the window during which you can still recover audit data after it has been deleted (either through the deletion schedule above, or from the live database directly).

    • On the Data Archival page (see details), click Recovery settings (top right).
    • Specify the number of days to hold recoverable data.
    Setting Default Valid Range
    Recovery window 20 days 0–30 days

    ⚠️ Important Setting the recovery window to 0 days causes deleted audit data to be deleted immediately, with no recovery possible. Set this only if your organization has no requirement to recover accidentally deleted data.

    View the deletion summary

    To review information about deletion of archive files:

    • On the Data Archival page (see details), click Deletion Summary.
    • Select the Deletion History tab to view recently deleted files.
    • Select the Deletion Schedule tab to view files scheduled for future deletion.

    Tip Enable the Alert Me feature to receive email notifications about the deletion schedule and deletion history of archive files.

    Restore Archived Data

    Restore Archived Data loads archived data back into ADAudit Plus so it appears in reports again, without waiting for a full database restore.

    Load archived data back for reporting

    • Log in to the ADAudit Plus web console.
    • Navigate to Admin tab → Integrations & Data Management → Restore Archived Data.
    • Use the Period selector to choose the date range of archived data you want to work with.
    • Use the Path and Category drop-downs to narrow down the archive files list to the report category and archive location you need.
    • Review the summary tiles at the top of the page:
    Tile Meaning
    Archive Files Total number of archive files matching the current filter
    Loaded Archive files currently restored and available in reports
    Unloaded Archive files not currently restored
    Loading/Unloading Files with a load or unload operation in progress
    • In the Available Archived Data table, select the archive file(s) you want to restore.
    • Click Load.

    Note Loading large or numerous archive files can take time and consume additional disk space and database resources while the data is restored. Restore only the files you need for the current reporting or investigation task.

    Unload restored data

    Once you no longer need restored data available in live reports, unload it to free up the resources it was consuming:

    • On the Restore Archived Data page, select the previously loaded archive file(s) in the Available Archived Data table.
    • Click Unload.

    Tip Configure the Number of days to hold Restored Data from Archive (via the Settings gear icon on this page) to have restored data automatically unload after a set number of days, instead of unloading it manually every time.

    View restored data in reports

    Once an archive file's status shows Loaded, its audit events become available in the corresponding report category's regular reports in ADAudit Plus. Navigate to the relevant report (for example, under Identity, Data, Cloud, Server, or Endpoint depending on the category) and apply a date range that includes the restored period.

    Archived Data Search lets you search across archived data using a search index, without restoring entire archive files first.

    Configure index settings

    • Log in to the ADAudit Plus web console.
    • Navigate to Admin tab → Integrations & Data Management → Archived Data Search → Index Files for Search.
    • Click the Settings gear icon.
    • Specify the Index Folder location where the search index will be stored.
    • Review the Max Index Files per Category limit (read-only).
    • Click Save.

    Note If GDPR mode is enabled, indexed data may be stored outside the standard ADAudit Plus data stores — review the in-product notice next to the Index Folder field before configuring an external location.

    • On the Index Files for Search page, use the Archive File(s) From date range and the Log Category drop-down to identify the archive files you want to make searchable.
    • Review the summary tiles: Archive Files, Files Indexed, Files Unindexed, and Indexing (in progress).
    • Select the archive file(s) you want to index, then start indexing from the table's row actions.

    Note Only indexed archive files can be searched using Archive Global Search. Files that are archived but not indexed will not appear in search results until they are indexed.

    • Navigate to Admin tab → Integrations & Data Management → Archived Data Search → Archive Global Search.
    • Set the date range for the search using the period selector.
    • Enter your search term and run the search.
    • Review the result summary, broken down by log category, and click a category's hit count to open the detailed report for that category.
    • In the detailed report, use the facet filters (in the left/side panel) to narrow results further, and export the results as CSV or PDF if needed.

    Verify the configuration

    After configuring archive settings, restore, or search:

    • Verify archiving is running: On the Data Archival page, check Status and Last Run Time — confirm the status shows Success, not a failure.
    • Verify disk space at the archive location: Confirm the configured archive folder or file server share has enough free space and is not approaching capacity.
    • Verify restore works: On the Restore Archived Data page, load a known archive file for a test category and confirm its data appears in the corresponding report.
    • Verify search works: On Archived Data Search, confirm recently indexed files show as Indexed (not stuck in Indexing), then run a test search and confirm expected results appear.
    • Verify recovery window behavior: Confirm the Deletion Schedule tab (under Deletion Summary) reflects the recovery window you configured. (see how).