Index lifecycle
EMS enforces index lifecycle management (ILM) policies. EMS associates each index with a lifecycle policy to optimize data retention and storage performance:
| Data age | Phase |
Description |
|---|---|---|
| Up to 45 days | Hot |
Data is actively indexed and queried. Index rolls over after 45 days or 50 GB, whichever is reached first. |
| Between 45 to 120 days | Warm |
Data is still available to be queried but moved to less resource-intensive storage. |
| More than 120 days | Cold |
Data is deleted automatically. |
EMS assigns each index a specific ILM policy:
| Index | Lifecycle policy |
|---|---|
| forticlientems_alerts-745-000001 | forticlientems_alerts-policy |
| forticlientems_pua-745-000001 | forticlientems_pua-policy |
| forticlientems_sysevs-745-000001 | forticlientems_sysevs-policy |
| forticlientems_vulns-745-000001 | forticlientems_vulns-policy |
EMS is limited to querying data for up to 30 days from the used indexes but internally uses data of up to 45 days to determine status changes.