Managing retention rules in Cayosoft Guardian

This article describes how to manage retention rules in Cayosoft Guardian. Retention rules need to be set up properly, keeping the performance and the size of your active database under control. All retention rules can delete records, and some retention rules support archiving to an archive database. To learn more about archiving, see Configuration: Managing archiving in Cayosoft Guardian .

How to modify an existing retention rule

1. Open Cayosoft Guardian web portal.
2. Expand the Configuration node.
3. Click the Retention rules node.
4. Double-click the retention you want to modify.
5. Edit the following values under Retention Settings:
   • Minimum records to keep
   • Group By
   • Order By
   • Retention action
6. Click Save.

Optionally, you can immediately run the retention job to apply changes to retention rules:

1. Expand Configuration node.
2. Click the Jobs node.
3. Select the retention job and click Run.

Configuring Retention Rule in Archive database

Cayosoft Guardian includes Retention Rules for Archive Databases. These rules allow administrators to automatically delete obsolete records—such as change history, change alerts, and threat alerts—after a defined retention period.

NOTE: These rules currently apply only to the default archive. Custom archives are not supported at this time.
 

IMPORTANT: If retention rules for archives are enabled, Cayosoft Guardian will begin deleting records from the selected archive database. Ensure your archive backup strategy is aligned before enabling this setting.

To configure a Retention Rule for the Archive database:

1. Open Cayosoft Guardian web portal.
2. Go to Configuration > Retention Rules.
3. Select or add a new rule for:
   1. Retention rule for Change History default archive
   2. Retention rule for Change Alerts default archive
   3. Retention rule for Threat Alerts default archive

4. In the rule properties, ensure the Path is set to system/archiveDatabases/default/changeRecords.

5. Check or uncheck Disabled depending on whether you want to activate the rule.
6. In Retention Settings:
   1. Select the retention policy type form the drop-down list.
      • Retention policy by time - This option retains or removes data based on how long it has been stored in the archive.
      • Retention policy by object - This option retains or deletes data based on specific object attributes or values.
      • Retention policy by count - This option retains or deletes a fixed number of the most recent records and removes older ones.
   2. Enter the desired number of days under Retain records for the specified number of days (e.g., 365)
   3. Choose createdDateTime as the Order By field.
   4. Set Retention action:
      • Remove - Permanently deletes records that meet the retention criteria.
      • Move to archive when available - Moves records to an archive location only if an archive is configured and accessible.
      • Always move to archive - Forces movement of eligible records to the archive, regardless of availability conditions.
7. Click Save.

TIP: You can use the Filter field to narrow down what records the rule applies to (optional).

How to retain change history records for the specified number of days

If it is required to keep change history records for a specific time interval, a retention rule must be properly configured. To change retention settings:

1. Use the instructions above to open the Change history retention rule.
2. In Retention settings, select Retention policy by time.
3. In Retain records for the specified number of days, enter the number of days, and click Save.

How to retain events for the specified number of days

If it is required to keep change history records for a specific time interval, a retention rule must be properly configured. To change retention settings:

1. Use the instructions above to open the Event log retention rule.
2. In Retention settings, select Retention policy by time.
3. In Retain records for the specified number of days, enter the number of days, and click Save.

Retention policies for backups

Some organizations require separate retention schedules for backups (e.g., daily, weekly, monthly) to meet compliance and recovery requirements while optimizing storage usage. The built-in retention rule in Cayosoft Guardian applies one schedule to all storage locations, which may not meet these needs.

To implement different schedules, disable the built-in rule and create custom retention rules for each storage type, location, and frequency. This ensures retention is aligned with compliance policies and prevents unnecessary storage consumption.