Lifecycle · obserae

The Settings group contains three pages that keep an obserae instance healthy over time:

Page	Use it to…
Storage	See where disk space is going and whether history is still being written.
Retention	Decide how long to keep flows, sessions and audit entries.
Backup	Create snapshots, rotate old ones and restore a previous state.

Changes made from these pages are persisted by obserae and survive daemon restarts. The YAML configuration provides the initial defaults; the UI becomes the source of truth once an operator changes a lifecycle setting.

Storage

The Storage page answers one question: is this instance keeping data at the rate and depth I expect?

It shows:

the database location and size;
free disk on the same mount;
flow/session history size;
enrichment and audit-log footprint;
backup directory size;
freshness and time span for retained history.

Use it during normal operation to spot three common problems:

Signal	What it usually means
Disk free is falling quickly	Retention is off, too wide, or traffic volume is higher than expected.
Flow history stopped updating	Exporters stopped, ingestion is unhealthy, or the instance is out of disk.
Backups are larger than expected	Rotation is too loose, or snapshots are being kept outside the managed directory.

The exact on-disk format is an implementation detail. Operationally, treat the values as “database”, “retained traffic history”, “audit log” and “backups”.

Retention

Retention is off by default. That makes a fresh install easy to evaluate: you can collect a few days of traffic, estimate daily growth, then choose a policy deliberately.

Turn retention on once you know how much history you want to keep.

Field	Default	Meaning
Flows max age	30 days	Raw flow records older than this can be removed.
Sessions max age	90 days	Session history older than this can be removed.
Audit log max age	Forever	Audit entries are kept unless you set a limit.

Set a value to 0 when that category should be kept forever. Be careful with the audit log: it is the forensic trail for operator actions, login events and configuration changes.

Cleanup

The page shows the last cleanup, the next automatic cleanup and what was removed. Click Clean up now after lowering a max age or when you need to reclaim space immediately.

A manual cleanup does not reset the automatic schedule.

First Cleanup On An Old Instance

If an instance has been running for weeks or months with retention off, the first cleanup can remove a lot of history. Run it during a quiet window if the machine is small or the stored history is large.

Backup

Backups capture the state needed to recover an obserae instance:

cartography, flow matrix, alerting, outputs, users, connectors and settings;
retained flow/session history;
enrichment state;
audit log history.

The backup page lets you enable scheduled snapshots, create one immediately and rotate old snapshots by age or count.

Field	Meaning
Directory	Where snapshots are written.
Interval	How often scheduled snapshots run. If the UI marks it read-only, change it in YAML and restart.
Max age	Remove snapshots older than this. `0` disables age-based rotation.
Max files	Keep at most this many snapshots. `0` disables count-based rotation.

Both rotation limits can apply at the same time. A snapshot must fit every enabled limit to be kept.

Backup Now

Backup now creates a snapshot immediately, even if scheduled backups are disabled. Use it before upgrades, major rule imports, large cartography changes or retention changes.

Large snapshots can briefly slow ingestion while the instance captures a consistent state. On small installs this is usually short; schedule production backups for quieter periods when possible.

Restore

Restore is available from the CLI. Always preview the restore plan before applying it:

obserae-cli backup list
obserae-cli backup plan --point-in-time 2026-05-28T13:00:00Z
obserae-cli backup restore --point-in-time 2026-05-28T13:00:00Z --dry-run --confirm
obserae-cli backup restore --point-in-time 2026-05-28T13:00:00Z --confirm

After a successful restore, obserae exits so your supervisor can restart it on the restored state. This is expected.

Keep the master key safe. It protects stored secrets and audit-log seals. See Operations before rebuilding an instance from backups.

Config I/O vs Backup

These two features solve different problems:

Feature	Restores	Best for
Config I/O	Operator-authored configuration: cartography, rules, alerting, outputs, connectors and lifecycle settings.	Versioning and moving configuration between instances.
Backup	Full instance state, including history and audit data.	Disaster recovery and point-in-time restore.

Use both in production: export configuration for review/version control, and run backups for recovery.