TOC & Recently Viewed

Recently Viewed Topics

Storage Configuration

The Storage section includes information about the database, including disk space limits for both the active and archive databases.

In addition to specifying the database address, port, and the archive directory for your databases, you can also specify storage limits for your active and archive databases. When your active database reaches the limit you have specified in your configuration, data in that database is moved to the archive database. When the archive limit is exceeded, the oldest archive database is deleted. If you do not want the archive databases to be deleted, set the value for the Archived Database Limit option to 0. In that case, storage should be regularly monitored to ensure that enough disk space is available for the active database. If the active database exceeds your license limit, that data will still be archived.

Note: If no archiving is enabled, the oldest 1 GB chunk of logs are permanently removed to make room for the newest 1 GB chunk of logs. A grace capacity of more than 1 GB is allowed such that the licensed limit of raw logs will always exist on disk after capacity is met. For example, a 1 TB license actually stores 1 TB + 1 GB, such that when the oldest chunk of logs is removed and the newest chunk size is 0 GB, there will still be 1 TB of raw logs on disk.

The following table describes the options that are available.

Option Description
Active Elasticsearch Database

Database Address

The IP address of the active Elasticsearch database. By default,

Database Port The port that the Elasticsearch database listens on. By default, port 9200.
Database On Disk Space

Displays the total raw storage capacity of the filesystem containing the specified Elasticsearch database. The disk space reflected should be greater than the size limit of the active database and restored archive combined. This value cannot be modified via the LCE interface. It is provided for informational purposes.

For example, if your Active Database Limit (see the Elasticsearch Indexes section of this table) was set to 20 TB, and the Restored Archive Limit (see the Archiving section of this table) was set to 30 GB, you would want at least 20.03 TB of raw storage capacity for the filesystem, in addition to space for the archive database.

Elasticsearch Indexes
Active Database Limit The maximum storage capacity that the active database can use. If you set this value to 0, the database will be limited only by your license. If the active database exceeds your license limit, that data will still be archived.
Archived Database Limit

The maximum storage capacity that the archive database can use. If you set this value to 0, the database will not be limited.

Caution: If you lower the Archived Database Limit, data may be lost if the value set is less than the current size of the archive database. You will receive a warning that data will be lost before you update your settings.

Archive Directory

The directory that stores data that exceeds your license or active database limit. By default, /opt/lce/archive/.

Note: Only local filesystem directories are valid. NFS is not supported.

Restored Archive Limit The maximum storage capacity that will be used to restore data from the archives for querying.

Copyright 2017 Tenable, Inc. All rights reserved. Tenable Network Security, Nessus, SecurityCenter, SecurityCenter Continuous View and Log Correlation Engine are registered trademarks of Tenable, Inc.  Tenable,, Assure, and The Cyber Exposure Company are trademarks of Tenable, Inc.  All other products or services are trademarks of their respective owners.