Evebox and sqlite: How to delete events when memory is too high

[pctsa]

Hello Evebox users, hello jasonish

I've been running Suricata without Evebox in a small network environment for some time now. I've now installed Evebox and am using sqlite as my database.
Unfortunately, I was careless, and my memory has grown to 70%. How can I delete the events in Evebox or sqlite, as described in issue #257? Is there a guide?

System: Debian GNU/Linux 12 (bookworm)

[jasonish]

There are a couple things you can do.

1. Go to the admin page (select the gear icon, admin). And there are some settings to limit the age of events kept, as well as size...

2. Delete the event database. First, stop EveBox. Then find the database files (maybe in /var/lib/evebox) and delete the files matching the pattern events.sqlite*. This will delete all events. Restart the server. Then I suggest going to the admin page and setting up some retention settings.

[pctsa]

Thank you for your help. I'm still testing it out. I've set "Delete Events older than" to one day, since I unfortunately don't have much storage space available. So far, it's looking good :-)