S 2.257 Monitoring of the memory resources of archiving media

Initiation responsibility: Head of IT, Archive Administrator

Implementation responsibility: Archive Administrator, Head of IT, Administrator

The free memory capacity available on the archiving media must be monitored continuously. If the free memory capacity falls below the threshold to be defined, the Administrator should be notified and this should be signalled to a system management environment, if required. If the free memory capacity continues to fall below a critical threshold, an alarm should be triggered. Regarding the generation of an alarm, it should be particularly ensured that the alarm is triggered in a role-related manner, i.e. independent of specific persons. This way, it is ensured that alarms can be triggered even in case of illness or absence.

The threshold, the critical threshold, as well as the escalation procedures and paths must be defined in an organisation-specific manner.

The definition of the thresholds must be based on the archiving media used and the average volume of the data to be archived. Upon triggering the critical alarm, it must be ensured that the average data volume can be archived continuously for a sufficiently long period. Typically, a residual capacity of 15% of the total capacity of the storage medium is used for the threshold and a residual capacity of 10% is used for the critical threshold.

In order to bypass possible supply bottlenecks regarding storage media, a sufficient number of empty archiving media should be stored at a known location. Here, the climate-related and physical storage conditions must also be met (see S 1.60 Appropriate storage of archiving media).

If alarms are generated, it must be documented how and when a reaction to the alarms is to take place. For example, this must be specified in Service Level Agreements (SLAs) if the archive system is operated by third parties.

Along with the memory capacity, it may also be required to monitor operating system- or application-specific restrictions. The corresponding program documentations must be checked regarding this. In cases of doubt or in the event of missing information in the documentation, the respective manufacturer should be consulted. For example, the number of maximum admissible files per directory or the maximum admissible database entries may be exceeded so that no further data can be created on the storage medium.

Review questions:

© Federal Office for Information Security. All rights reserved.