Compression

Some detection rules, especially if not optimally configured for your needs, can generate thousands of events per hour. If a ticket is not being promptly investigated and closed on time, the body of accumulated data can grow enormously.

To make the investigation manageable older tickets are regularly "cleaned up". Compression of certain data items allows to maintain both the database storage and specific tickets at a reasonable size, making LogMan.io Alerts much faster and more flexible.

Enable Compression

To enable a specific compression type, the corresponding section must be present in the configuration of LMIO Alerts in /Site/model.yaml.

/Site/model.yaml

services:
  lmio-alerts:
    asab:
      config:
        compression:event:
          enabled: yes

Hint

For release v26.12:

In case of a cluster configuration that uses a common database enable compression on one instance only.

Compression checks are performed every 12 hours.

Events Compression

Compression is regularly performed for associated events and their timeline records, meaning some events assigned to the ticket are removed.

These are default parameters for events compression that can be changed in /Site/model.yaml.

Default Configuration

[compression:event]
ticket_lifetime=1W # (1)
events=100 # (2)
trailing=10 # (3)
trigger=10 # (4)

1. Only tickets older than 1 week are being compressed
2. Keep 100 events in a ticket
3. Keep 10 latest events, the rest being the oldest events of this ticket
4. Do not compress data unless 10+ extra items have been accumulated

Supported age postfixes:

• Y: year, respectively 365 days
• M: month, respectively 31 days
• W: week
• D: day
• h: hour
• m: minute

For example: "3h" (three hours), "5M" (five months), "1y" (one year) and so on.