Retention settings

    ManageEngine SecureAI keeps a growing record of its own operation—the backups it takes of its database, the logs and audit reports it archives, and the records of every notification it has attempted and access certification it has run. Retention settings give you control over how long these records are stored, allowing you to keep them for only as long as your retention policy requires. This prevents your database and disk from exceeding space limits, all while preserving necessary evidence your organization may be obliged to provide.

    How it works

    Each retention period governs one type of record, and a cleanup scheduler applies it every week. Every run deletes the records of the record type that are older than the set retention period. Because SecureAI retains no copy of what a cleanup has removed, deletion is permanent. If no period is set for a record type, none of its records will be deleted and the volume it holds will continue to grow. Backup files are the exception. Their cleanup runs daily and only while a database backup schedule is active. A period set for backup files has no effect on an installation that takes no scheduled backups. SecureAI holds a single set of retention periods that applies product-wide. Two periods can also be set from the feature they belong to: The period for backup files can be set from the database backup configuration, and the period for archived audit reports can be set from the audit report archive settings. Both routes write the same stored value, so the two never diverge. Having no period configured in Retention Settings for either option is equivalent to retaining all records of their respective features.

    Prerequisites

    Complete the following before you configure retention settings:

    • Log in with a role that includes the Server Settings permission under Administration. This is required as retention settings is one of the properties of this permission and it cannot be delegated on its own. The Super Admin and Governance Manager roles within SecureAI include it.
    • Verify the period each type of record must be kept for with the team responsible for your organization's retention or audit obligations. This is because a cleanup cannot be reversed and SecureAI holds no copy of what it removes.
    • Enable the database backup schedule before you set a period for backup files, since the cleanup for backups runs only while backups are scheduled.
    • Confirm the location SecureAI writes audit report archives to. Shortening the retention period for archives frees space on that disk rather than in the database.
    Note:
    • SecureAI holds one set of retention periods for the whole product. Separate periods for individual teams, instances, or record owners are not available.
    • The cleanup interval cannot be set from Retention Settings. SecureAI runs the cleanup weekly, and the backup file cleanup daily.
    • Records that a cleanup has removed cannot be recovered from SecureAI.
    • Archived audit reports are kept in years. Months are only offered for archived logs, notification history, and access certification history.
    • A period entered against an option that is not selected is discarded when you save, and the option keeps the period stored against it.
    • A period of zero raises no error. The change saves and the option comes back cleared.
    • Retention Settings reports neither when the last cleanup ran nor how much a period will remove.

    Configuration instructions

    1. Navigate to Settings > General Settings > Server Settings, then to the Retention Settings tab.
    2. Select each kind of record that has to be removed after a period, and set the period against it:
      • Retain database backup files: Select Last 15 days or Last 30 days to keep the backups taken within that period, or select Last 10 files, Last 20 files, or Last 30 files to keep that many of the most recent backups.
      • Archived logs retention period: Enter a number and select Months or Years.
      • Archived audit reports retention period: Enter the number of years.
      • Notification history retention period: Enter a number and select Months or Years.
      • Access Certification history retention period: Enter a number and select Months or Years.
    3. Clear an option to keep that kind of record indefinitely.
    4. Click Save Changes. Click Cancel to discard the changes and return the options to the periods last stored.

    Tips

    • Set each period against how long the records have to be kept, not against how much disk space you want to maintain. Notification history is often the only evidence that shows an approver was notified, and audit archives are usually the first thing an auditor asks for.
    • Keeping backup files by count gives you a predictable disk footprint even when the backup frequency changes. Keeping backup files by age gives you a predictable recovery window. Pick the one your recovery plan is written around.
    • The first cleanup after an option has been off for a long time is the largest one it will ever run. Turn a new period on during a maintenance window rather than during a working day.
    • Retention settings and the database backup configuration are governed by different permissions, Server Settings and Database Settings. When these permissions belong to different teams, decide which team owns the backup retention value since whichever team saves last overwrites the other.
    • Access certification history is held against the campaign that produced it, so a period set in Retention Settings may shorten the run record a certifier or an auditor can refer to. Confirm the period against how far back your certification program has to be evidenced.