Showing results for 
Show  only  | Search instead for 
Did you mean: 

Events Service Snapshot incremental backup retention best practice


Hi Everyone,


I have a question regarding the incremental backup snapshot in the Events Service.

If we want to keep the Events Service snapshot to always run in incremental (backup runs daily), does that mean we can't delete the indices file backup under the indices folder? What if we want to keep only the last 7 days of backup data (backup runs daily)?
Any best practice on the Events Service snapshot data housekeeping or snapshot retention settings?


Thanks for your reply!






AppDynamics Team

Hi @Yan.Solomon ,


Thank you for posting to the community.

Event Service is using Elasticsearch, and each snapshot is independent and restorable to that point in time, so you can delete old unnecessary snapshots even though it is incremental.
You can use the Elasticsearch API calls to delete the snapshots and indices backup files under indices folder.


Please see the document below for Elasticsearch API.


1. All snapshots currently stored in the repository can be listed using the following command:
curl -X GET "localhost:9200/_snapshot/<my_backup>/_all?pretty"
Replace <my_backup> with your snapshot repository name.
<appd_home>/events-service/processor/bin/ snapshot-list -p <appd_home>/events-service/processor/conf/


Snapshot repository name can be found by the following command:
curl -X GET "localhost:9200/_snapshot?pretty"


*If the repository name contains a slash, you may not be able to list snapshots with curl command. In that case, please add a new repository with a simple name having same setting so that you can use the simple name instead.
curl -X PUT "localhost:9200/_snapshot/<simple_repository_name>" -d '<same_setting_with_existing_one>'


2. A snapshot can be deleted from the repository using the following command:
curl -X DELETE "localhost:9200/_snapshot/<my_backup>/<snapshot_id>?pretty"

Above command also deletes all files that are associated with the deleted snapshot and not used by any other snapshots.

If you needs to keep only the last 7 days of backup data, you may just keep 7 days of snapshots.


Note that you need to enable port 9200(Events Service debugging port) as written in the knowledge base below.


Best Regards,

Found something helpful? Click the Accept as Solution button to help others find answers faster.
Liked something? Click the Thumbs Up button.
June 26 Webinar
Discover new Splunk integrations and AI innovations for Cisco AppDynamics.

Register Now!

Observe and Explore
Dive into our Community Blog for the Latest Insights and Updates!

Read the blog here