General Purpose
The Index Management screen is used to manage the retention periods, statuses, and system resource usage of event and incident indexes within Logsign USO. This section allows you to determine which indexes remain active (Open), which are set to read-only low-memory state (Frozen), which ones are set to passive (Closed), and how long they are retained in the system.
Index Lifecycle
As event indices age, they move through a staged lifecycle that reduces resource usage without losing data:
Open → Frozen → Closed → Deleted
- Open: Active and fully performant; readable and writable.
- Frozen: Read-only and low-memory; not deleted, not closed, and still searchable (searches may be slower).
- Closed: Offline; must be reopened before it can be searched.
- Deleted: Removed from the system once the total retention period is exceeded.
Index Management Configuration
Frozen Data Retention Period (Days)
Event indices older than this value are automatically frozen. Frozen indices are not deleted and remain searchable, but keep memory usage to a minimum. 0 = disabled.
Closed Data Retention Period (Days)
Event indices older than this value are closed. Closed indices are offline and must be reopened before they can be searched. 0 = disabled.
Total Event Retention Period (Days)
This field defines how many days event logs will be retained in the system. Once the specified duration expires, the related indexes will be automatically deleted from the system.
The recommended value is 7 days. Keeping data longer may increase disk usage and CPU consumption.
Incident Retention Period (Days)
This field determines the number of days incident indexes (case data) are retained in the system. When the duration expires, these indexes will also be automatically deleted.
Note: The periods must preserve the order Frozen ≤ Closed ≤ Total. Otherwise the configuration cannot be saved. (A field set to 0 is treated as disabled.)
Don't query frozen (throttled) indices
This option controls whether searches include frozen indices. It is checked by default and is the recommended setting.
- Checked (recommended): Searches and reports skip frozen indices, keeping queries fast.
- Unchecked: Searches and reports include frozen indices. This gives access to older/frozen data, but query performance can drop significantly when many frozen indices are queried alongside active ones.
This setting only affects search scope; it does not affect retention or cause any data loss.
Index List Section
This section lists all indexes currently available in the system. Each card represents one index file.
The displayed information includes the index name (for example: log_20251104), size, document count, and status.
Index Statuses
- Open: The index is active and fully searchable. Searches, reports, and dashboards can be executed using this index.
- Frozen: The index is frozen; searchable but with slower performance and low memory usage.
- Closed: The index has been set to a passive state. It cannot be used for search or reporting operations. However, it can be reopened when needed. This helps reduce system resource consumption, especially RAM and CPU usage.
Index Actions
- Open / Close Selected: Manually open or close the selected indices. Can be done individually or in bulk.
- Freeze Selected / Unfreeze Selected: Manually freeze or unfreeze the selected indices. Can be done individually or in bulk. Today's active index cannot be frozen. A frozen index can be returned to the Open state at any time using Unfreeze.
Recommendation:
Keeping the number of active (Open) indexes low helps improve overall system performance. It is recommended to retain live data for a maximum of one month, ideally one week. Older indexes can be kept in the Closed state and temporarily reopened when historical data access is required. For data that must be retained longer but is rarely queried, the Frozen state offers a balance between storage efficiency and searchability.