Disk Usage Categories
This page goes into more detail on the types of data managed by the various disk usage sections on the rWeb Configurations page. Data older than its history setting will be deleted automatically. Entries with "Forever" will never be deleted automatically, though for some of these categories data can be removed by direct user action.
| Category | Description | Additional Comments |
|---|---|---|
| Alerts | Space used by rWeb alerts | |
| Destination allow list | Spaced used for configuring destination allow lists | Not adjustable |
| Device management | Spaced used for configuration of RIOS devices managed by this rWeb | Not adjustable |
| Director action history, Director trigger history | Space used to record Director Action and Trigger history, respectively. | |
| Director host metrics (30 seconds, 5 minutes, 1 hour, 1 day) | Space used for storing Director Host metrics. | This data is also used when viewing Director Aggregate Metrics. |
| Director interface metrics (30 seconds, 5 minutes, 1 hour, 1 day) | Space used for storing Director Interface metrics. | |
| Director zone metrics (30 seconds, 5 minutes, 1 hour, 1 day) | Space used for storing Director Zone metrics. | This data is also used when viewing Director Aggregate Metrics. |
| Filter list | Space used for storing Filter List queries, clear commands, and the underlying data for both | |
| Licensing | Space used for all licenses stored on the rWeb | Not adjustable |
| Logs | Space used for storing underlying system logs and the per device and rWeb oriented versions presented to users | |
| Other | Space used for internal components without direct user functionality | Not adjustable |
| Report | Space used for storing completed reports | Old reports can also be directly deleted on the report tab |
| RIOS | Space used for storing RIOS versions that can be staged to filter devices for upgrades | Not adjustable, though space can be freed by directly deleting versions under the RIOS Management section |
| rWeb backup | Space used by any generated rWeb backups | Not adjustable |
| rWeb management | Space used for configuring rWeb itself | Not adjustable |
| Sample packet | Space used by storing sample packets generated for victims | |
| Source block list | Space used for storing source block list configuration | Not adjustable |
| Source allow list | Space used for storing source allow list configuration | Not adjustable |
| Support upload | Space used for storing device support uploads | |
| Tcpdump | Space used for storing previously captured tcpdumps | |
| Top Application, Top Application 30 seconds, Top Application 5 minutes | Space used for storing Top Application data, seperated by each interval type (the one without a time label is a half hour interval) | |
| Top attacker, Top attacker 30 seconds, Top attacker 5 minutes | Space used for storing Top Attacker data, seperated by each aggregation interval type (the one without a time label is a half hour interval) | |
| Top list, Top list 30 seconds, Top list 5 minutes | Space used for storing Top List data, seperated by each aggregation interval type (the one without a time label is a half hour interval) | |
| Top protocol, Top protocol 30 seconds, Top protocol 5 minutes | Space used for storing Top Protocol data, seperated by each aggregation interval type (the one without a time label is a half hour interval) | |
| Top VLAN, Top VLAN 30 seconds, Top VLAN 5 minutes | Space used for storing Top VLAN data, seperated by each aggregation interval type (the one without a time label is a half hour interval) | |
| Traffic configuration | Space used by all traffic configuration, including groups, zones, templates, and zone filtering configuration | Not adjustable |
| Traffic detail, Traffic detail 1 day, Traffic detail 1 hour, Traffic detail 5 minutes | Space used by traffic detail data, separated by each aggregation interval type (the one without a time label is ~30 second data) | Higher time intervals cannot be set below the next lowest interval (e.g. if 1 hour is set to a week you cannot set 1 day to 3 days retention). Additionally, 30 second data cannot be kept less than 2 hours and 5 minute data cannot be kept less than 2 days |
| Traffic overview | Space used for raw interface statistics reported by devices | |
| Traffic summary, Traffic summary 1 day, Traffic summary 1 hour, Traffic summary 5 minutes | Space used by traffic summary data, separated by each aggregation interval type (the one without a time label is 30 second data) | Higher time intervals cannot be set below the next lowest interval (e.g. if 1 hour is set to a week you cannot set 1 day to 3 days retention). Additionally, 30 second data cannot be kept less than 2 hours and 5 minute data cannot be kept less than 2 days |
| Victim detail | Space used for storing internal details about a victim | |
| Victim summary | Space used for storing general victim statistics from devices and the collated version as presented by rWeb |