sqlite: file size based retention

Allow a max file size on the SQLite database. Events will be aggressively purged from the database to maintain this size. Closes #256
jasonish · Mar 13, 2023 · efa9b9e · efa9b9e
1 parent 879ab87
commit efa9b9e
Show file tree

Hide file tree

Showing 15 changed files with 399 additions and 149 deletions.
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -64,6 +64,7 @@ webbrowser = "0.8.7"
 yaml-rust = "0.4.5"
 futures = "0.3.21"
 regex = "1.5.5"
+libc = { version = "0.2.140", default_features = false }
 
 [patch.crates-io]
 # Patch Rusqlite for now. 0.28.0 uses SQLite 3.39, but 3.40 is much

diff --git a/examples/evebox.yaml b/examples/evebox.yaml
@@ -51,9 +51,17 @@ database:
     #username: username
     #password: password
 
-  # Retention period in days. Default 7 days.
-  # - Set to 0 to disable.
-  retention-period: 7
+  retention:
+    # Only keep events for the past 7 days.
+    # - SQLite only
+    # - Default 7 days
+    # - Set to 0 to disable
+    days: 7
+
+    # Maximum database size.
+    # - SQLite only
+    # - No default
+    #size: "20 GB"
 
 authentication: