TOC & Recently Viewed

Recently Viewed Topics

Silo Archiving


  • Total size of activeDb is limited by config attribute active-size (default: 20 TB).
  • Total size of archiveDb is limited by config attribute archive-size (default: 20 TB).

Control Flow

Every 2.5 minutes, LCE will:

  1. Read in the results of the last-executed action, from LCE status database.

  2. Choose the next action to take based on the last-executed action.

  3. Perform the next action and store results in LCE status database.

Storing the state in this manner has the following advantages:

  • simplicity (no separate logic to handle reloads/restarts is needed)

  • transparency (to see exactly where the archival algorithm is, just query the LCE status database.)

  • available emergency override (can alter the control flow by updating the LCE status database.)

    Note: This is not standard operating procedure and should only be performed in very rare cases.

LCE waits a maximum of 75 minutes for an archive job to complete in order to avoid being stuck in the CheckArchiveDone state indefinitely in the rare case that Elasticsearch fails to report an archive job as complete.

Note: Archiving a silo normally takes 6 to 8 minutes.

See Elasticsearch Administration and Troubleshooting Utilities for descriptions of relevant archiving tools.


Copyright © 2019 Tenable, Inc. All rights reserved. Tenable,, Tenable Network Security, Nessus, SecurityCenter, SecurityCenter Continuous View and Log Correlation Engine are registered trademarks of Tenable, Inc.., Lumin, Assure, and the Cyber Exposure Company are trademarks of Tenable, Inc. All other products or services are trademarks of their respective owners.