System Administration and Maintenance
Routine administration
Daily checks include system health, disk usage, S-TAP status, buffer usage, and aggregation success. Audit data grows continuously, so use archive and purge to keep the internal database from filling. Archive writes data to remote storage; purge removes it locally. Schedule both and verify the archive before purge.
Backup and restore
A full system backup captures the appliance; a configuration backup captures settings. Store backups off-appliance, test restores, and restore only to the same or a compatible version. Keep configuration backups before policy changes and upgrades.
Commands and maintenance
grdapi and clia automate tasks such as backup, purge, and service restarts. NTP and DNS must be correct; time zone changes affect report buckets and cross-unit comparisons. Apply patches in maintenance windows and preserve must_gather output for support.
Worked example
A collector reaches 80% disk. Create an archive job to NFS for partitions older than 90 days, run it, and confirm file counts. Then create a purge job for the same window. Schedule archive at 01:00 and purge at 03:00 nightly. Verify free space and confirm reports covering the retained period still resolve.
Traps
Purging before archiving; changing the time zone and misreading historical reports; backup jobs that omit configuration; unsynchronized NTP causing distributed units to disagree.