Change the Location of Event Data Logs

By default, Secure Access saves event data logs to its California data warehouse location. You can change the location of the data warehouse for your organization from North America to Europe at any time.

Only event data is stored in the data warehouse. This is any data that might appear in a Secure Access report. Configuration data, such as audit logs and policy settings, remain stored by Cisco in California regardless of a change to the data warehouse's location.

Implications When You Change Data Warehouse Locations

When you change the location of the data warehouse from North America to Europe or Europe to North America, the data that your reports use changes. Because Secure Access' reports use the data saved to logs that are stored to the data warehouse, only data from the data warehouse's current location is available to reports. Existing logs do not change locations. Data stored in North America stays in North America. Data stored in Europe stays in Europe. To generate reports using data from the previous data warehouse location, you must change the data warehouse location back to the previous location.

🚧

Caution

Although you can change back from the European data warehouse location to the North American data warehouse location, we do not recommend this procedure. Changing back and forth between data warehouse locations results in the splitting of your Secure Access event data between locations. This splitting lessens the accuracy of your Secure Access reports. We strongly recommend that once you change the location of your data warehouse from North America to Europe that you do not change back unless the change back is intended to be permanent.

Note: When you change the data warehouse's location, Secure Access' reporting functionality is temporarily suspended while the switchover to a new location occurs. For activity search data, the switchover period lasts only a few minutes; however, other reporting data may take several hours to begin appearing in reports.

Log Retention

Logs are deleted when the retention date expires as per the Secure Access Privacy Data Sheet.

Logs are not deleted when you change the data warehouse location.

Prerequisites

• Full Admin user role. For more information, see Manage Accounts.

Procedure

1. Navigate to Admin > Log Management. In the Data Storage area, click Change Location.

2. Select a new location and click Next.

3. Confirm that you understand the consequences of changing the location where logs are physically stored and click Change.

The data warehouse location is changed and Secure Access now stores event data logs to this new location. Logging to the old location stops.
Note: Logs stored at the previous location are not deleted until the retention period expires—30 days for detailed data and two years for summary data.

Enable Logging to a Cisco-managed S3 Bucket < Change the Location of Event Data Logs > Stop Logging