> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/learn-about-cortex-xsoar/customize-and-configure-cortex-xsoar/manage-data/free-up-disk-space-with-data-archiving.md). # Free up Disk Space with Data Archiving **Archive Incident, Entry, and Indicator Data** To free up disk space, you can archive compressed folders to save unused or old data. It is recommended to archive folders and not delete them permanently. Cortex XSOAR supports full archiving of incident, entry, and indicator data on a monthly basis. For Elasticsearch deployments, see [Archive Data with Elasticsearch](/xsoar-6-administrator-guide/6.13/learn-about-cortex-xsoar/onboarding-in-cortex-xsoar/elasticsearch/archive-data-with-elasticsearch.md). For Hosted Service deployments, contact Customer Support. Locate the folders that reside in the following location (where Cortex XSOAR is installed), `/var/lib/demisto/data/`. {% hint style="info" %} ### Note Although the folders reside in `/var/lib/demisto/data/`, **Do Not** save the backup folders under `/var/lib/demisto/`. {% endhint %} The instructions below refer to paths for a single server deployment. For multi-tenant, you archive data on a per tenant basis. The following are the equivalent paths for multi-tenant: | Single Server | Multi-Tenant | | ------------------------- | --------------------------------------------------- | | /var/lib/demisto/ | /var/lib/demisto/tenants/acc\_{`TENANT_NAME`}/ | | /var/lib/demisto/data/ | /var/lib/demisto/tenants/acc\_{`TENANT_NAME`}/data/ | | /var/lib/demisto-archive/ | /var/lib/demisto-archive/acc\_{`TENANT_NAME`}/ | The following data folder and files can be found in this folder: * **`demisto.db`**: The database for all playbooks and automation (not anything related to incidents and insights). * **`demistoidx`**: Indexing of the system. * **`partitionsData`**: Data of incidents, insights, and entries separated by month resolution. If you archive indexes you need to archive the matching partitions, so they are not rebuilt. The following is an example of how the folders and filenames will appear in your system. ```screen $ tree /var/lib/demisto/data ├── demisto.db ├── demistoidx │ ├── accounts │ │ ├── index_meta.json │ │ └── store ... │ ├── entries_082017 │ │ ├── index_meta.json │ │ └── store │ ├── entries_092017 │ │ ├── index_meta.json │ │ └── store │ ├── entries_102017 │ │ ├── index_meta.json │ │ └── store │ ├── evidences │ │ ├── index_meta.json │ │ └── store │ ├── incidents_082017 │ │ ├── index_meta.json │ │ └── store │ ├── incidents_092017 │ │ ├── index_meta.json │ │ └── store │ ├── incidents_102017 │ │ ├── index_meta.json │ │ └── store │ ├── investigations_082017 │ │ ├── index_meta.json │ │ └── store │ ├── investigations_092017 │ │ ├── index_meta.json │ │ └── store │ ├── investigations_102017 │ │ ├── index_meta.json │ │ └── store ... │ ├── newInsights_082017 │ │ ├── index_meta.json │ │ └── store │ ├── newInsights_092017 │ │ ├── index_meta.json │ │ └── store │ ├── newInsights_102017 │ │ ├── index_meta.json │ │ └── store │ ├── playbooks │ │ ├── index_meta.json │ │ └── store ... └── partitionsData ├── demisto_082017.db ├── demisto_092017.db └── demisto_102017.db ``` Follow these steps to create data archive folders. {% hint style="info" %} ### Note In a distributed database deployment, first stop the app server and then the databases. Then run this procedure on each database that contains incidents. By default, you only need to run this procedure on the secondary nodes. However, in distributed database deployments that were converted from a single server deployment, there is incident data in the main database. Therefore, you also need to run this procedure on the main database. {% endhint %} 1. Stop the Cortex XSOAR service using the following command. **`$ sudo service demisto stop`** 2. Create the following directories. The following steps use the year 2019 as an example. **`mkdir /var/lib/demisto-archive`** **`mkdir /var/lib/demisto-archive/archived-2019`** 3. Navigate to the `/var/lib/demisto-archive/` folder. **`cd /var/lib/demisto-archive/`** 4. Move the data you want to archive to the archive directory. The following command moves all folders that have a mmyyyy suffix. **`mv /var/lib/demisto/data/**/*_* /var/lib/demisto-archive/archived-2019`** For example: **`mv /var/lib/demisto/data/**/*_092019* /var/lib/demisto-archive/`** Multi-tenant example: **`mv /var/lib/demisto/tenants/acc_{`*****`TENANT_NAME`*****`}/data/**/*_* var/lib/demisto-archive/archived-2019`**

Note

If the mv /var/lib/demisto/data/**/*_<date_to_archive>* /var/lib/demisto-archive/archived-2019 command does not work in your environment, archive the indices and partition separately. First create the following directories:

mkdir /var/lib/demisto-archive/archived-2019/demistoidx/

mkdir /var/lib/demisto-archive/archived-2019/partitionsData/

Then, archive each index and the partition that has a mmyyyy suffix. The following are the commands to archive the current indices and the partition:

sudo mv /var/lib/demisto/data/demistoidx/entries_082019 /var/lib/demistoarchive/archived-2019/demistoidx/

sudo mv /var/lib/demisto/data/demistoidx/evidences_082019 /var/lib/demistoarchive/archived-2019/demistoidx/

sudo mv /var/lib/demisto/data/demistoidx/incidents_082019 /var/lib/demistoarchive/archived-2019/demistoidx/

sudo mv /var/lib/demisto/data/demistoidx/invTaskIdx_082019 /var/lib/demistoarchive/archived-2019/demistoidx/

sudo mv /var/lib/demisto/data/demistoidx/investigations_082019 /var/lib/demistoarchive/archived-2019/demistoidx/

sudo mv /var/lib/demisto/data/demistoidx/newInsights_082019 /var/lib/demistoarchive/archived-2019/demistoidx/

sudo mv /var/lib/demisto/data/demistoidx/todosTask_082019 /var/lib/demistoarchive/archived-2019/demistoidx/

sudo mv /var/lib/demisto/data/partitionsData/demisto_082019.db /var/lib/demisto-archive/archived-2019/partitionsData/demisto_082019.db

5. Create the compressed archive of your selected files and folders using the following tarball command: **`$ tar -cvzf demisto-2019-archive.tar.gz /var/lib/demisto-archive/archived-2019`** 6. Start the Cortex XSOAR service. **`$ sudo service demisto start`** --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/learn-about-cortex-xsoar/customize-and-configure-cortex-xsoar/manage-data/free-up-disk-space-with-data-archiving.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.