Large amounts of inactive and stale data inflate costs and increase risk with little value in return – particularly on tier 1 storage.

Reduce capital expenditures related to storage, and facilitate strong data lifecycle and retention management practices by identifying, eliminating, and/or archiving stale data.

Follow the guide below to identify stale data with Varonis DatAdvantage.

Browse to Category 07 Inactive Resources then expand “Report Name b. Inactive Directories by Size.”

Expand the Predefined subsection then click on “01. Inactive Directories by Size”

The default blank template is displayed on the right viewing panel.  There two mandatory filters – Date and Event count – required for each Stale data report.

The date filter controls the activity look-back period.  For example, setting the date filter at 60 days instructs the report to only list folders that have not been accessed for 60 days prior to the report run date.

The “event count” filter sets the maximum amount of file touches (open, modify, delete, rename, etc.) that can occur on any top-level folder – not including sub-folders – to consider the data stale.

The “event counter on sub-folders” filter sets the maximum amount of activity that can occur on any folders beneath an inactive point.

For example, by setting both of these event count settings to 0, only completely inactive hierarchies will appear in the report.

A safe starting look-back period is 60 days, but adjust the value based upon organizational needs.

Leave the Event count filters both set to 0.

Bring up the server picker by clicking the “…” icon next to File Servers.  Place a check box next to in-scope file servers.  Click OK on the picker to return to the main filters.

Optional:  To run this report on all monitored file servers, check the box next to the File server filter on the main set, and click Remove Selected.

Click on the Column tab.

Select “Last Accessed Time” from the Your Selection list on the right then click the “<” arrow to remove the column.

Select “Size of folder and subfolders” from the “Your selection” list then click the “<” arrow to remove the column.

Select “Assigned Owner” from the “Your selection” list then click the “<” arrow to remove the column.

Optional – For installations without at least 60 days of auditing data, file system metadata is available as a supplement.  File system metadata can be inaccurate, as various processes may update the access timestamps.

Select “Access Date” from the “Available columns” list then click the “>” arrow.

Select “Access Date” from the”Available columns” list then click the “>” arrow.

The easiest way to view this data is by size in descending order, so the largest stale sets bubble to the top.  Return to the Filters tab by clicking “Filters” along the top.

To view, or configure the sort order, click on the “Sort” icon at the right of the filter bar.  The default sorting is by size of folders and subfolders.  Click on that link to view the sorting menu then mouse over “FS properties” to expand the list, then click on “Size of folder (in MB)” to make the selection.

Ensure the sort order is set to “Descending.”  If it is incorrect, click on the link next to the sort filter, and select descending.

Click on the Run arrow to execute the report

The report output will show the file server and access path to the data, along with the size of that individual folder with the largest at the top.

Operational

When running this report for defined data owners using a data-driven subscription model, remove the “File server” selection so the report appears as below.