24.3 Change the Settings of a Storage Group

After creating or modifying storage groups, you must apply the changes. You can modify multiple groups before applying your changes.

24.3.1 Modify a Storage Group

You can modify a storage group at any time.

  1. Select Configuration > Storage.

  2. Select the storage group that you want to modify.

  3. Select .

  4. For Group Status, slide the indicator left or right.

    Activated groups will display a status of Active.

  5. Select SAVE.

  6. Apply your changes.

24.3.2 Apply Your Changes to a Storage Group

Select Configuration > Storage > Apply Changes to System.

When you change the query filter, status, or rank of a storage group, your changes do not go into effect until you apply the changes. The following considerations affect how your changes are applied:

  • If you modify the query filter, Recon will begin adding events that match the updated filter. However, the storage group retains all currently stored events associated with the previous filter. The retention policies continue to apply to all events within the group.

    If you do not want the storage group to have both sets of events, you can create a new storage group for the updated query filter, then deactivate the older storage group.

  • On the first day of the month, Recon deletes events matching the retention policies of the storage groups. For example, on March 15, you change the deletion time to three months from four months. On April 1, Recon begins deleting all data older than three months.

  • While changes are being applied, you cannot create or modify a storage group.