Triages, file acquisitions, and data acquisitions can accumulate over time and use an increasing amount of disk space. To control this, you can allot a set amount of disk space for them.
Ten percent of the disk space you specify is reserved for automatic triage acquisitions. When the total allotted acquisition space is exceeded, the oldest automatic triages are deleted.
When the total disk size of completed acquisitions exceeds a specified limit, the Endpoint Security (HX) appliance deletes the oldest completed acquisitions until enough disk space is cleared to bring the total under the specified limit. Acquisitions that are not yet completed are not affected.
The Endpoint Security (HX) appliance automatically deletes acquisitions if an Administrator, Analyst, or Investigator uses the Endpoint Security (HX) Web UI to manually delete the associated agent.
Admin access
Specifying disk utilization limits using the Web UI
Log in to the Endpoint Security (HX) Web UI.
Select Disk Utilization Limits from the Configure section in the main menu.
In the Acquisition space limit area, specify the maximum amount of disk space (in GB) that can be used to store triage, file and data acquisitions. Valid values and defaults vary based on your Endpoint Security (HX) appliance model. The values appropriate for your model are shown on the Disk Utilization Limits page.
Click Save.
Specifying disk utilization limits using the CLI
Enable CLI configuration mode:
hostname > enable hostname # configure terminal
Change the disk space limit for completed acquisitions:
hostname (config) # hx server acquisition aging disk-limit <MB>
For <MB>, specify the maximum amount of disk space (in MB) that can be used to store triage, file and data acquisitions. Valid values and defaults vary based on your Endpoint Security (HX) appliance model. The values appropriate for your model are shown in the help for this command (enter
hx server acquisition aging disk-limit ?).To restore the default disk space limit for completed acquisitions:
hostname (config) # no hx server acquisition aging disk-limit
Save your settings;
hostname (config) # write mem