From 90cccd2d570027b50871f6601cacf5b4ab0d8e84 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 19 Aug 2026 05:31:11 -0700 Subject: [PATCH] Fix guides/security-analyzer: retention never runs without retention_check_interval MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The guide sets retention_check_enabled and retention_period but no retention_check_interval. RetentionBuilder::build() returns None when check_interval is unset, so the retention task never starts — silently, with no warning. With refresh_mode: append nothing else evicts old rows, so the guide's claim that retention_period keeps a month of history does not hold. Add retention_check_interval: 1h, say why both settings are needed, and add the missing step that starts the runtime and runs analyzer.py — the guide defines the script but never tells the reader to run it. --- guides/security-analyzer/README.md | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/guides/security-analyzer/README.md b/guides/security-analyzer/README.md index ac85b96e..f5d9e97e 100644 --- a/guides/security-analyzer/README.md +++ b/guides/security-analyzer/README.md @@ -93,6 +93,7 @@ datasets: refresh_check_interval: 5s retention_check_enabled: true retention_period: 30d + retention_check_interval: 1h params: pg_host: ${env:PG_HOST} pg_port: ${env:PG_PORT} @@ -106,7 +107,7 @@ Let's break down these configuration choices: - `refresh_mode: append` optimizes for real-time log ingestion by only appending new data based on the `time_column` - `refresh_check_interval: 5s` provides near-real-time analysis -- `retention_period: 30d` keeps a month of history for pattern analysis +- `retention_period: 30d` with `retention_check_interval: 1h` keeps a month of history for pattern analysis, sweeping expired rows hourly. Both are required: without `retention_check_interval` the retention check never starts, and in `append` mode nothing else evicts old rows. ## Adding AI-Powered Analysis @@ -259,6 +260,18 @@ if __name__ == "__main__": analyzer.analyze_patterns() ``` +## Running the Analyzer + +Start the runtime, then run the analyzer in a second terminal: + +```bash +spice run +``` + +```bash +uv run analyzer.py +``` + ## Testing the System To see our security copilot in action, let's simulate some suspicious patterns: