The alert and incident retention conditions are determined by the following criteria:
Retention period. By default, KUMA retains alerts and incidents for 365 days, but you can set a different period by changing the Alert retention period, days setting.
Deletion conditions. After the expiration of the specified retention period, if certain conditions are satisfied, alerts and incidents may be retained further.
There are no limitations on the size of a stored alert.
Setting the retention period for alerts and incidents
To change the retention period for alerts and incidents in the KUMA web interface:
In the KUMA web interface, go to the Settings → Other → General section.
In the General window, under Core properties, specify the Alert retention period, days.
The retention period for alerts and incidents will be changed.
Alert and incident deletion conditions
KUMA applies the following alert and incident deletion conditions:
If an alert is older than the retention period, its events are deleted regardless of the alert status.
If an alert is older than the retention period, has the Closed status, and is not linked to an incident, the alert is deleted.
If an alert is older than the retention period (regardless of the alert status) and is linked to an incident whose retention period has not yet expired, the alert events are deleted, the alert without events is available for display and remains linked to the incident without the events.
If the incident is older than the retention period, the status of the incident is Closed, and it has no linked alerts, the incident is deleted.
If an incident is older than the retention period, the status of the incident is Closed, and only alerts older than the retention period are linked to it (the status of alerts linked to a closed incident is always Closed, incident closed), the incident is deleted together with all its alerts and events.
If an incident is older than the retention period (regardless of the status of the incident), and it has linked alerts that have not yet expired, nothing is deleted.
If an incident is older than the retention period, has a status other than Closed, and alerts older than the retention period are linked to the incident, the incident is not deleted, alerts are not deleted, but events of the alerts are deleted.
Empty alerts (alerts without events whose retention period has expired) are deleted together with incidents when the incident satisfes deletion conditions in accordance with the retention period are satisfied (the incident has the Closed status and its retention period has expired).
If an incident is older than the retention period, the status of the incident is Closed, and it has linked alerts that are older than the retention period and some alerts that fall within the retention period, such an incident is not deleted. Alerts whose retention period has not expired are not deleted. Events of alerts whose retention period has expired are deleted and the alerts themselves remain empty and linked to the incident.