IBM Support

QRadar: Backups removed by the retention period

Question & Answer


Question

Why are some backups not removed by the backup retention period?

Answer

When you set the backup retention in the backup and recovery tab, an option in Backup Recovery Configuration allows administrators to set a retention period.

image 7817

image 7856
The Backup Retention Period applies only to scheduled backups. On-Demand Backups are not subject to the retention period and have to be removed manually.
By design, the backup retention management services will only delete scheduled backups if the total number in storage exceeds the number of days configured in the Backup Retention Period (days) field. This applies to scheduled data and config backups separately.

For example, if there is a config backup older than the 7 day retention period, but there's less than 7 total config backups stored in the Backup Repository Path directory, that backup will not be automatically deleted. Once the total number of config backups exceeds 7, the oldest backups will then be deleted. 

[{"Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwsyAAA","label":"Admin Tasks"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Version(s)"}]

Document Information

Modified date:
27 March 2024

UID

ibm16403866