Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 1 reply
  • Subscribers 1 subscriber
  • Views 701 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

How long Sophos keep the Device Control exemption data ?

angtee

I using Console 4.5.09,
i accidently delete the policy in device control and loss all the exemption for removable storage, i try to add back all exemption data from
Device control - Event viewer but only can view data within 1 year although i select custom from 1/Jan/2010 - 6/July/2011.
So anyway to trace back all the data, because i need the 2010 May data. Please help

:14685


This thread was automatically locked due to age.
  • 0

    Hello angtee ,

    SEC automatically purges the events after 12 months (see paragraph 4 in this article).

    In order to restore the events (not the exemptions) from May 2010 you'd need a database backup from before May 2011 - and while it requires some knowledge and careful execution it is not impossible (provided you do have the backup).

    If it is not feasible to re-create the exemptions (the same way you created them in the first place) and you have a database backup from "just before" you deleted the policy (you do back up the database regularly?) it might be possible to either restore the policy or to create a new policy and alter the PolicyXML value. In any case you should check with Support.  

    Perhaps you should also submit a feature request as currently only the Firewall policy and the Data Control rules can be exported and imported (and thus backup up/restored to protect against accidental loss like in your case).

    Christian

    :14701