Configuring the event storage Settings

Event storage is also known as the ring buffer. You can set the event storage use limit and the storage mode for the resource use policy for all of your host endpoints or selected host sets using the Web UI or the API.

The event storage limit represents the number of megabytes of storage that can be used for tasks performed on behalf of the Endpoint Security (HX) server.

If the agents' events database exceeds the storage specified by this setting, the agent rebuilds the database. If the database is corrupt and the attempt to rebuild it fails, a new, empty events database is created. The old events database is backed up as file events.db.bk. You may need assistance from Trellix Technical Support to extract the data contained in the backup.

The event storage mode allows you to adjust event storage I/O handling and physical disk I/O use. If your host endpoints experience a degradation in I/O processing times, use this setting to optimize event storage I/O handling and reduce the physical disk I/O use. The default settings is conventional.

Important

Changing storage mode may lead to the loss of historical data. Complete all incident response investigations on your host endpoint before changing the storage mode.

The storage_mode setting is only available for agents running Trellix Endpoint Security (HX) xAgentversion 21.33.7 or later.

In Endpoint Security (HX) xAgent version 26, databases operate more reliably and allow for automatic recovery whenever possible.

The table below describes the available storage modes.

Storage Mode	Description	Configuration
Conventional	This is the default storage mode. This storage mode stores write events in batches before writing them to the events database on disk. Important Use one of the other storage modes only if your endpoints experience a degradation in I/O processing times.	To select the default storage mode, remove the `storage_mode` key from the configuration file.
Memory-mapped I/O with log	This is the recommended memory-mapped storage mode. In this storage mode, read and write operations are backed by memory and backed by an on-disk journal file. Write transactions are written to the Write Ahead Log file (`events.db-wal`) then committed to the events database. The journal file prevents database corruption caused by unexpected restarts. This mode produces efficient disk I/O performance because read transactions are in memory. Memory-mapped I/O with log mode improves disk I/O performance for two reasons. Event processing does not need to transition to kernel mode to read and write data. Event data is stored in memory as much as possible and is written to the events database only when necessary. Before changing to this storage mode in your production environment, you should first determine the impact of the change in a test environment.	To select this storage mode, set the storage_mode key to `mmapiowithlog`.
In-memory	This storage mode stores the events database in memory. This mode increases memory usage, but improves disk I/O performance. Consider the following caveats before switching to in-memory storage mode. The in-memory events database is volatile. Events in the in-memory database are lost when the agent restarts or when event processing is restarted. Consequently, in-memory mode is best used for machines that remain running for long periods (such as servers). Any previous events database on disk remains untouched and unmodified. Events stored in it are not transferred to the in-memory database. If you switch back to the default storage mode, your agent resumes updating the events database on disk and the events in the in-memory database are lost.	To select this storage mode, set the `storage_mode` key to `inmemory`.
Memory-mapped I/O NOT RECOMMENDED	Use of this storage mode is not recommended because it may cause failure of Real-time Event storage and functionality. Please use MMAPIOWITHLOG. This storage mode uses memory mappings to back up read and write operations, and uses paging to optimize the read and write operations.	To select this storage mode, set the `storage_mode` key to `mmapio`.

This section covers how to set the event storage use limit using the Web UI. See the Endpoint Security (HX) REST API Guide for more information on setting the event storage use limit using the API.