storage_mode Key

The storage_mode key identifies the agent's disk storage mode. Only change this setting if your host endpoints experience a degradation in I/O processing times.

Important

Changing storage mode may lead to the loss of historical data. Complete all incident response investigations on your host endpoint before changing the storage mode.

The table below describes the available storage modes.

Storage Mode	Description	Configuration
Conventional	This is the default storage mode. This storage mode stores write events in batches before writing them to the events database on disk. Important Use one of the other storage modes only if your endpoints experience a degradation in I/O processing times.	To select the default storage mode, remove the `storage_mode` key from the configuration file.
Memory-mapped I/O with log	This is the recommended memory-mapped storage mode. In this storage mode, read and write operations are backed by memory and backed by an on-disk journal file. Write transactions are written to the Write Ahead Log file (`events.db-wal`) then committed to the events database. The journal file prevents database corruption caused by unexpected restarts. This mode produces efficient disk I/O performance because read transactions are in memory. Memory-mapped I/O with log mode improves disk I/O performance for two reasons. Event processing does not need to transition to kernel mode to read and write data. Event data is stored in memory as much as possible and is written to the events database only when necessary. Before changing to this storage mode in your production environment, you should first determine the impact of the change in a test environment.	To select this storage mode, set the storage_mode key to `mmapiowithlog`.
In-memory	This storage mode stores the events database in memory. This mode increases memory usage, but improves disk I/O performance. Consider the following caveats before switching to in-memory storage mode. The in-memory events database is volatile. Events in the in-memory database are lost when the agent restarts or when event processing is restarted. Consequently, in-memory mode is best used for machines that remain running for long periods (such as servers). Any previous events database on disk remains untouched and unmodified. Events stored in it are not transferred to the in-memory database. If you switch back to the default storage mode, your agent resumes updating the events database on disk and the events in the in-memory database are lost.	To select this storage mode, set the `storage_mode` key to `inmemory`.
Memory-mapped I/O NOT RECOMMENDED	Use of this storage mode is not recommended because it may cause failure of Real-time Event storage and functionality. Please use MMAPIOWITHLOG. This storage mode uses memory mappings to back up read and write operations, and uses paging to optimize the read and write operations.	To select this storage mode, set the `storage_mode` key to `mmapio`.

Change this setting using one of the following methods:

API custom configuration channels (see Using API Custom Configuration Channels).
Manually on individual endpoints using a text editor (see Modifying the Configuration File for a Single Endpoint).
Manually by using the Endpoint Security UI.