The Event Collector has two concepts,
"archive" which refers to *backing up* the data. The archive command
backs up the data from a certain date until the most current date. By default,
it runs once per week, archiving the last 7 days of data, and optionally
copying it to an scp server. The archiving (backup) process creates files
called EC-Archive*.tgz in the admin's /Backup directory.
In order to fully
restore an EC from backups, you restore your earliest archive through to your
most recent, in order. Whether archiving is done once a week or daily and when
it it done can be configured with the EC admin shell by entering
"configure archive".
The other concept is
what they are looking for here. It's called "offline" data. This is
data that is stored in an external file that is not searchable, and can then be
moved onto a different server for long-term storage. It can be brought back
online at any time if needed.
By default, data is
taken offline when either:
- It is more than 365 days old
- Total online data is more than 200GB
(A slight
complication is that data is taken offline in 400MB chunks, so the most recent
data in a chunk must meet the 365 day mark for the chunk to be taken offline.)
Offline data is
stored in files named "EC-Offline*.tgz". Offline data is not
searchable unless it is brought back online via the "online" command
in the admin shell:
online
<offline-file-name>
Entering
"online" without parameters will list any offline files that have
been placed online for searching. Entering "offline
<file-name>" with one of the files listed will take it offline
again.
The 365 day figure
can be changed via "configure offline".