Retention Policies

Retention policies delete events that match a specified signal, once they reach a certain age. A typical retention scheme for Seq might be:

• Delete Debug and Verbose events after 48 hrs
• Delete events from non-production environments after 7 days
• Delete all remaining events at 30 days

Each of these rules is represented by a retention policy.

Your retention policies will depend on the rate of incoming events, available machine resources, and organizational needs.

👍

Tip

To get rid of a particularly noisy event flooding your logs, consider applying a filter directly upon arrival using API keys.

Setting up a Retention Policy

In this example we'll create the policy implementing the rule:

Delete Debug and Verbose events after 48 hrs

The first step in creating a retention policy is to create a signal specifying the events to delete.

To select debug and verbose events, enter the filter:

@Level in ['Debug', 'Verbose']

Then press the add to signal button at the right of the filter bar. Call the signal "Retained 48 hrs".

Your events screen should look something like:

In the button group below the signal's name, choose Shared, then save the signal.

📘

Signals for retention policies must be shared

Personal signals won't be available for selection in the retention policy setup screen. Make sure you marked the signal as Shared in the previous step.

To prevent other users inadvertently modifying the signals use for retention policies, you can also select Protected from the signal editor's drop-down menu.

Next, click Settings in the top menu bar, and choose Retention in the left menu.

Click Add Policy to create the new policy. Give the policy a name, and select the newly-created view in the Delete drop-down:

Click Save Changes to save the policy.

Retention Processing

Retention policy processing happens in the background, so you won't notice an immediate change in disk usage.

🚧

Retention processing consumes resources

Each retention policy requires some CPU and disk time in order to run. Aim to consolidate requirements into 3-5 retention policies at most, if possible.

The All events policy is the cheapest to run, as Seq can use optimized file operations to remove old data; setting up an All events policy is recommended.

Excluding Events from Processing

To save an event from being deleted by retention processing, you can Permalink the event, using the Permalink menu you'll see when the event is expanded.

Permalinked events won't be shown in search results once retention processing deletes them, but, the event will still be available at the URL provided in the Permalink dialog.

You can view and edit your personal permalinks under your user preferences.

📘

What happens if the disk fills up?

Seq will stop ingesting new events if the amount of free space on the storage volume falls below the limit set in Settings > System > Minimum free storage space.