LogLogic LMI will always store raw and index data on local storage first. Only after the data is written to local storage will the engine_archive process move it to archive storage (NAS or SAN) based on the archive threshold value (75% disk usage by default). In this way, both local and SAN/NAS storage can be utilized simultaneously, thus making archive storage function as online storage. Because the archiving feature triggers it's operations based on disk usage there isn't any way to correlate when data will be archived based on its age. A disk will be filled up more quickly when events are collected at a higher rate and disk storage will be consumed faster if indexing is enabled.

Note that only one archive storage method can be used at a time so NAS and SAN are configured in a mutually exclusive manner for any given appliance and the SAN option is only available on physical appliance models containing the 'SAN" suffix in their name.