Compression and file rotation options for persisted logs are edited under Settings > Data Management > Data Retention, in the Persist Settings section at the bottom of the page. After changing a value, click Save.
Compression Format: Selects the compression method used for persisted logs. The options are None, Bzip and Gzip. The default is Gzip. A single format applies to both the RAW and the JSON log files; there is no separate JSON compression setting.
Compression Level: You can select the compression level of persisted logs on Logsign Unified SecOps Platform. The level to be selected can be from 1 to 9, and the default is 9.
As the level increases, the compression ratio of the logs also increases. In this way, disk storage is used with less capacity. However, the offline report feature may also give results a bit late.
For example, if the ratio 9 is selected, the compression ratio will increase up to 1/20. The offline report feature may give the results a bit late. On the other hand, if ratio 1 is selected, the compression ratio will be about 1/2, but offline report will give much faster results.
Rotate Period: Sets how often the open log files are closed and new ones are started. By default, "Daily" is set, so one file is kept per day. You can also choose 1 Hour, 2 Hours, 3 Hours, 4 Hours, 5 Hours, 6 Hours, 8 Hours or 12 Hours. With an hourly period, the files are closed at fixed hours of the day (for example every 6 hours: 00:00, 06:00, 12:00 and 18:00) and the file name carries the time slot, which gives smaller files that are easier to move or archive.
The same section also contains the Delete Archived Data Before and Delete Signed Data Before fields, which control how long archived and signed log files are kept.