Implemented the baseline/noise and SQLite growth improvements.

This commit is contained in:
larssand
2026-06-29 19:58:49 +02:00
parent 6ea8bfd714
commit d764c5a038
8 changed files with 205 additions and 15 deletions

View File

@@ -237,6 +237,29 @@ The continuous monitor also stores a local SQLite behavior baseline at
five-minute windows. Historical rate and hitcount-rate deviations then contribute
to its anomaly score. Set `FGAI_BASELINE_DB` to use another location.
SignalScope prunes old baseline buckets during each monitor cycle. The defaults
keep 14 days of buckets and dedupe history, prune stale one-off categorical
values after 7 days, and cap high-cardinality values per stream/entity/field.
Tune these in the dashboard or in `state/fgai-config.json`:
```json
{
"baseline_retention_days": 14,
"baseline_value_retention_days": 7,
"baseline_max_values_per_field": 2000
}
```
If an existing baseline database has already grown large, stop the monitor and
run a manual prune plus SQLite compaction:
```bash
signalscope baseline-maintenance --baseline-db state/fgai-baseline.sqlite3 --retention-days 14 --value-retention-days 7 --max-values-per-field 2000 --vacuum
```
`VACUUM` can take time on a large database and should not be run while the
monitor is actively writing.
Analyze local logs:
```bash