This commit is contained in:
@@ -53,11 +53,13 @@ BASELINE_SUPPRESS_FOR=1h
|
||||
#BASELINE_MIN_COUNT=20
|
||||
# Metadata-first storage
|
||||
# Raw XML is disabled by default. Enable only for short forensic retention.
|
||||
STORE_EVENT_ROWS=false
|
||||
STORE_RAW_XML=false
|
||||
METADATA_BUCKET=1m
|
||||
EVENT_RETENTION=72h
|
||||
RAW_RETENTION=24h
|
||||
METADATA_RETENTION=4320h
|
||||
METADATA_CONTEXT_EVENT_IDS=4624,4625,4648,4672,4720,4726,4728,4732,4740,4756,4768,4769,4771,4776
|
||||
METADATA_BUCKET=5m
|
||||
EVENT_RETENTION=6h
|
||||
RAW_RETENTION=6h
|
||||
METADATA_RETENTION=720h
|
||||
|
||||
# Partition maintenance
|
||||
PARTITION_MAINTENANCE_ENABLED=true
|
||||
|
||||
Reference in New Issue
Block a user