Data Maintenancev7.0.20

The appliance database does its own housekeeping only up to a point: row-retention tables expire automatically, the partitioned log tables are pruned by hand, and the daemons’ tuning values sit behind a super-admin gate. These endpoints are where all three are read and adjusted.

These endpoints belong to the system functional area; an MCP or OAuth token needs the mcp:system scope, and the calling user needs the permission shown on each endpoint. Most endpoints here require permission:system; the per-service tuning endpoints (/api/daemon/*) are super-admin only and require permission:sa.

Two cross-cutting points apply to the whole chapter:

• Retention vs. partitions are two different mechanisms. Row-retention tables (disk, latency, interface, ports, and the alert/speedtest/discovery janitors) expire old rows automatically against the per-table retention policy. The four high-volume partitioned log tables (syslog, event log, EVE, and walk history) do not auto-expire in this release — they are pruned only by an operator through the partition-management endpoints, by an explicit number of weeks.
• Response envelope. The retention and partition endpoints wrap their payload in a {status, hasError, message} object, where message carries the actual data (or an error string when hasError is true). The per-service tuning endpoints return bare JSON objects instead. Each endpoint below shows its real shape.

Data retention

The data-retention policy drives the “Database Retention” card in the appliance UI: one row per managed table, each with a retention value (in days) that the database janitor uses to expire old rows. Only row-retention tables appear here — the partitioned log tables are not part of this policy and are managed separately (see Partition management).

List the retention policy

GET/api/getRetentionPolicysystem

Returns every managed table together with its current retention value and the table’s total on-disk size in bytes. Use this to render or audit the retention configuration.

Response 200

{
  "status": 201,
  "hasError": false,
  "message": [
    { "id": 1, "table": "disk", "retention": 30, "size": 41992192 },
    { "id": 2, "table": "latency", "retention": 30, "size": 10780672 }
  ]
}

Example

curl -sS https://APPLIANCE/api/getRetentionPolicy \
  -H "Authorization: Bearer $TOKEN"

Update retention values

POST/api/setRetentionPolicysystem

Updates the retention (in days) for one or more managed tables. Send an array of {id, retention} objects under data; each id must match an existing policy row and each retention must be at least 1. The whole submission is rejected if any row fails validation.

Request body

Response 200

{ "status": 201, "hasError": false, "message": "ok" }

Errors

Example

curl -sS -X POST https://APPLIANCE/api/setRetentionPolicy \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d '{"data":[{"id":1,"retention":60},{"id":2,"retention":45}]}'

Partition management

The high-volume log tables (syslog, event log, EVE, and walk history) are stored as weekly date-range partitions of a parent table. These endpoints let an operator inspect the partition layout, prune old partitions by age, move data between tablespaces, and inspect or change the per-table rotation schedule. Pruning is the only way these tables shed data this release — there is no automatic expiry.

Every partition endpoint accepts both a short and a long form of its table/partition argument for backward compatibility (table or tableName; partition or partitionName; tablespace or tablespaceName; schedule or cronSchedule). Supply either — the long form takes precedence when both are present.

List partitioned tables

GET/api/getPartitionedTablessystem

Returns the names of every partitioned parent table, the starting point for any partition-management workflow.

Response 200

{ "status": 200, "hasError": false, "message": ["syslog_log", "eventlog_log", "eve_log", "walks_log"] }

Example

curl -sS https://APPLIANCE/api/getPartitionedTables \
  -H "Authorization: Bearer $TOKEN"

List a table’s partitions

POST/api/getTablePartitionssystem

Lists every partition of a single table, with a human-readable size, the covered date range, whether it is the live (_latest) partition, and its tablespace.

Request body

Response 200

{
  "status": 200,
  "hasError": false,
  "message": [
    {
      "partition_name": "syslog_log_2026_06_07",
      "size": "128.4 MB",
      "size_bytes": 134638592,
      "date_range": "From 2026-06-07 to 2026-06-14",
      "is_latest": false,
      "tablespace": "default"
    }
  ]
}

Errors

Example

curl -sS -X POST https://APPLIANCE/api/getTablePartitions \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d '{"tableName":"syslog_log"}'

Rotate a partition

POST/api/rotatePartitionsystem

Rolls the table’s live _latest partition over to a dated partition and creates a fresh _latest to receive new rows. This is housekeeping only — rotation never deletes data.

Request body

Response 200

{ "status": 200, "hasError": false, "message": "Partition rotated for syslog_log" }

Errors

Example

curl -sS -X POST https://APPLIANCE/api/rotatePartition \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d '{"tableName":"syslog_log"}'

Delete partitions older than N weeks

POST/api/deleteOldPartitionssystem

Drops every dated partition of a table older than the explicit weeks retention window. This is the operator-driven prune path for the partitioned log tables — there is no automatic expiry, so this (or Delete a partition below) is how these tables free disk.

Request body

Response 200

{
  "status": 200,
  "hasError": false,
  "message": "Deleted 3 partition(s) older than 8 weeks",
  "details": { "deleted_count": 3, "retention_date": "2026-04-20" }
}

Errors

Example

curl -sS -X POST https://APPLIANCE/api/deleteOldPartitions \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d '{"tableName":"syslog_log","weeks":8}'

Delete a partition

POST/api/deletePartitionsystem

Drops one named partition. Use this for surgical removal when Delete partitions older than N weeks is too coarse.

Request body

Response 200

{ "status": 200, "hasError": false, "message": "Partition syslog_log_2026_04_05 deleted" }

Errors

Example

curl -sS -X POST https://APPLIANCE/api/deletePartition \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d '{"partitionName":"syslog_log_2026_04_05"}'

List available tablespaces

GET/api/getAvailableTablespacessystem

Lists the PostgreSQL tablespaces partitions can be moved to. If the database has no extra tablespaces a synthetic default entry is returned so the UI always has at least one target.

Response 200

{
  "status": 200,
  "hasError": false,
  "message": [
    { "name": "default", "location": "system", "size": "N/A" }
  ]
}

Example

curl -sS https://APPLIANCE/api/getAvailableTablespaces \
  -H "Authorization: Bearer $TOKEN"

Get a table’s tablespace

POST/api/getTableTablespacesystem

Returns the tablespace a table currently lives in. A table on the cluster default returns the string "default".

Request body

Response 200

{ "status": 200, "hasError": false, "message": "default" }

Errors

Example

curl -sS -X POST https://APPLIANCE/api/getTableTablespace \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d '{"tableName":"syslog_log"}'

Move a table to a tablespace

POST/api/moveTableToTablespacesystem

Moves a table (and, by default, its indexes) to another tablespace — for example, relocating bulk log data to a larger or cheaper volume. The move rewrites the table and holds a lock while it runs, so schedule it during a maintenance window.

Request body

Response 200

{ "status": 200, "hasError": false, "message": "Moved syslog_log to tablespace fast_ssd" }

Errors

Example

curl -sS -X POST https://APPLIANCE/api/moveTableToTablespace \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d '{"tableName":"syslog_log","tablespaceName":"fast_ssd","includeIndexes":true}'

Get a table’s rotation schedule

POST/api/getTableCronSchedulesystem

Returns the cron expression that drives automatic weekly partition rotation for a table.

Request body

Response 200

{ "status": 200, "hasError": false, "message": { "schedule": "0 0 * * 0", "jobid": 7 } }

Example

curl -sS -X POST https://APPLIANCE/api/getTableCronSchedule \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d '{"tableName":"syslog_log"}'

Update a table’s rotation schedule

POST/api/updateTableCronSchedulesystem

Sets the cron expression for a table’s automatic partition rotation. The schedule controls rotation only (rolling _latest to a dated partition) — it never deletes data.

Request body

Response 200

{ "status": 200, "hasError": false, "message": "Schedule updated for syslog_log", "jobid": 7 }

Errors

Example

curl -sS -X POST https://APPLIANCE/api/updateTableCronSchedule \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d '{"tableName":"syslog_log","cronSchedule":"0 0 * * 0"}'

Daemon configuration

Each background service on the appliance carries a set of tuning values (“dvars”) plus a flag controlling whether it starts automatically. These endpoints read and write those values and let an operator turn a service’s autostart on or off. They are super-admin only.

Get a service’s configuration

GET/api/daemon/{identifier}sa

Returns a single service together with its full list of tuning values. The identifier may be the numeric service id or the service name.

Path parameters

Response 200

{
  "id": 12,
  "name": "emailmond",
  "start_auto": true,
  "config": [
    { "var": "interval", "value": "60" },
    { "var": "authpass", "value": { "__encrypted__": true } }
  ]
}

Errors

Example

curl -sS https://APPLIANCE/api/daemon/emailmond \
  -H "Authorization: Bearer $TOKEN"

Update a service’s configuration

POST/api/daemon/{id}/configsa

Replaces the full set of tuning values for a service, then signals the running service to reload them. Send the complete config array — it overwrites the existing values entirely.

Path parameters

Request body

Response 200

{ "message": "Configuration updated successfully" }

Errors

Example

curl -sS -X POST https://APPLIANCE/api/daemon/12/config \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d '{"config":[{"var":"interval","value":"30"},{"var":"authpass","value":{"__encrypted__":true}}]}'

Set a service’s autostart

POST/api/daemon/{id}/startsa

Turns a service’s automatic startup on or off. The supervisor picks the change up on its next cycle; the running service itself is not reloaded by this call.

Path parameters

Request body

Response 200

{ "message": "Start auto setting updated successfully" }

Errors

Example

curl -sS -X POST https://APPLIANCE/api/daemon/12/start \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d '{"start_auto":true}'