Events
Read-only log of system events generated by fault detection. Events are emitted by ingest (scanner heartbeat timeouts), dispatcher (stuck scan reconciliation), and the manager health evaluator (infrastructure checks). Events are immutable and retained for 90 days by default.
Fields & columns
| Name | Description |
|---|---|
Time | When the event was recorded |
Source | Which service emitted the event: ingest, dispatcher, or manager |
Type | Event type following naming convention: _down/_up (e.g., scanner_down, db_up), _failed (e.g., backup_failed), _high/_normal (e.g., db_connections_high), _expiring/_renewed (e.g., tls_expiring), _stuck (e.g., scan_stuck) |
Severity | Event severity: critical, high, warning, or info |
Entity | What the event is about — entity_type:entity_id |
Summary | Human-readable description of the event |
Gotchas
- Events are read-only — they cannot be modified or deleted through the API.
- Events older than 90 days are purged by the manager, once a day. The window is the manager's SYSTEM_EVENTS_RETENTION_DAYS variable. To change it, set that variable in .mipo.env and deploy (a whole number of days; a shorter window deletes the older records at the next daily pass — see "Retention windows" in docs/operations/production-install.md).
- Events are only emitted on state transitions, not on every health check poll.
- Only Time and Type can be sorted. The list is read a page at a time from a large table, so the server orders it, and only by its two indexed columns.
- Recovery events (e.g., scanner_up) have severity "info" and auto-resolve matching alarms.
API calls (1)
| Method | Path | Description |
|---|---|---|
| GET | /api/health/alerting/events | List system events with optional filters (eventType, severity, entityType), paging (limit, offset) and sort + dir (sort is timestamp or eventType; any other value is a 400) |
Related
- Alarms — Alarms are created from events by the alarm evaluator
- Alarm Rules — Rules define which event types trigger alarms