Licensing
LogRhythm offers Axon licensing options with durations of either a 90-day Time-to-Live (TTL) or a 400-day TTL. Upon expiration of the purchased TTL, any data exceeding this timeframe will be deleted.
Access to data via Dashboards is restricted according to the following limitations:
| TTL | Dashboard Time Range |
|---|---|
| 90 | Last 30 Days |
| 400 | Last 90 Days |
Should you require to visualize data beyond these specified durations, initiate a Search and utilize the visualization tab. It is possible to save the search along with its associated visualization tab to create a long-term data dashboard.
Licensing Overview
The Licensing Overview page provides Axon Administrators with a summary of their license agreement.
To view licensing information, from the Dashboard:
Click the Administration cog in the lower-left corner.
Click Licensing in the Overview section.
The Licensing Overview page appears.
The following information is available on the Licensing Overview page:
| Field | Description |
|---|---|
TTL | The number of days for which data will be stored. Once met, data will age out of the system. |
Daily Ingest | The licensed daily ingest value in GB. If exceeded, data ingest rates will be temporarily throttled. |
License Warnings and Violations
The Daily Ingest portion of your Axon license refers to how much data you may ingest in a 24 hour period. If you exceed your licensed Daily Ingest amount, you will be issued a license warning. Each time a license warning is issued, all Administrator users in the system will receive an email alert stating that the license has been exceeded for that day. Data will still be ingested and indexed.
If you receive more than 10 license warnings in a rolling 30 day period, you will incur a license violation. When a license violation is incurred, all Administrator users in the system will receive an email alert stating that they are in violation of the license. Your LogRhythm account team will be in contact shortly thereafter to discuss recent usage trends and ensure that the license sizing is appropriate. Data will still be ingested and indexed.
Reports
The number of saved Scheduled Reports you can have at any one time is limited by your license. Scheduled reports can be saved for 30 days, after which time they will be removed from the Reports page, and will need to be scheduled again.