Storage Management
A comprehensive guide to managing database size, media disk usage, and configuring automated retention policies in Login AlertX.
Overview
On continuously running workstations, laptops, and enterprise servers, security monitoring can accumulate thousands of login events, webcam snapshots, and diagnostic logs over time. Without proper storage governance, historical databases and media caches can grow unchecked.
Introduced in Login AlertX v4.2.0, the dedicated Storage Management module provides complete real-time visibility into local disk usage, automated risk-tiered retention policies, and one-click cleanup controls — ensuring Login AlertX maintains a virtually negligible storage footprint indefinitely.
Real-Time Storage Metrics
The Storage Management view provides live diagnostics of the application’s local footprint:
Database Size
Tracks the size of the transactional SQLite database (events.db) storing event logs, anomaly baseline tables, and outbox queues.
Media Captures Folder
Calculates total disk space consumed by local webcam snapshots, desktop screenshots, and ambient audio recordings.
Total Event Records
Live tally of all active audit records currently stored in your searchable local event history.
Risk-Tiered Automated Retention
Rather than applying a crude “delete everything older than 30 days” rule, Login AlertX enables risk-stratified retention. This ensures critical security incidents are preserved for compliance and investigation while routine events are recycled promptly:
| Classification | Typical Events Included | Recommended Retention | Rationale |
|---|---|---|---|
| Low Risk | Routine morning logins, normal desktop unlocks, standard screen locks during working hours. | 7 to 14 Days | Routine benign activity requires minimal retention; purging keeps database search speeds instant. |
| Medium Risk | Off-hours logins, unfamiliar Wi-Fi network connections, first-time interactive console sessions. | 30 to 60 Days | Provides adequate investigation window for behavioral anomalies that warrant periodic review. |
| High Risk | Failed login spikes (Event 4625), brute-force attempts, RDP remote breaches, tamper alerts. | 180+ Days / Forever | Critical forensic evidence must be preserved for compliance, auditing, and threat attribution. |
Automated Maintenance & Database Vacuuming
Login AlertX handles database hygiene automatically:
- Daily Scheduled Pruning: The background Windows service / Linux daemon evaluates records daily during quiet hours and purges events that have exceeded their designated retention thresholds.
- Media File Cleanup: When an event record is purged, its associated webcam snapshots and audio clips are automatically deleted from the disk to reclaim space.
- SQLite VACUUM & WAL Checkpointing: Automatically reclaims free disk pages and reorganizes indexes to maintain sub-millisecond query performance.
On-Demand Storage Actions
Need to reclaim disk space immediately? You can trigger manual cleanup actions with a single click:
- Prune History Older Than…: Select a custom threshold (e.g. older than 7, 30, or 90 days) and click Clean History.
- Clear Media Captures: Removes stored photos, screenshots, and audio clips from disk while preserving the searchable text event history.
- Wipe Database: Completely resets the local audit history and compacts the database back to initial install size.
How to Access Storage Management
- Open Login AlertX from the system tray.
- In the sidebar navigation, click Storage Management.
- Review your real-time disk statistics.
- Select your preferred retention duration for Low, Medium, and High risk classifications.
- Click Save Policy.