My enviroment has an USM standar server and four sensors, all together generating, sustainedly, about 200 events every second. So, my "working window", to assess all alarms and reviewing for interesting events, is narrowed to about 2,3 days [40000000 events/(200 events/s *60*60*24)], before all stored events being flushed to logger. What can I do, to enlarge that "working window" to about 7 days, without spend more money in another server or sensor?. Where to tune my enviroment?. Plugins?, Policies?, Correlation directives?.