Log Storage

routerd keeps long-lived state separate from operational logs.

The default layout is:

File	Purpose	Typical retention
/var/lib/routerd/routerd.db	resource state and event table	30 days for events
/var/lib/routerd/dns-queries.db	DNS query rows from routerd-dns-resolver	30 days
/var/lib/routerd/traffic-flows.db	conntrack-derived traffic flows	30 days
/var/lib/routerd/firewall-logs.db	firewall accept/drop/reject rows	90 days

The log tables use column names that can be mapped to OpenTelemetry log attributes. nDPI and TLS SNI columns are reserved in traffic-flows.db, even when no writer fills them yet.

LogRetention removes old rows and can run SQLite incremental vacuum:

apiVersion: system.routerd.net/v1alpha1
kind: LogRetention
metadata:
  name: default
spec:
  schedule: daily
  incrementalVacuum: true
  targets:
    - file: /var/lib/routerd/routerd.db
      retention: 30d
    - file: /var/lib/routerd/dns-queries.db
      retention: 30d
    - file: /var/lib/routerd/traffic-flows.db
      retention: 30d
    - file: /var/lib/routerd/firewall-logs.db
      retention: 90d

Inspection commands:

routerctl dns-queries --since 1h
routerctl traffic-flows --since 1h
routerctl firewall-logs --since 24h --action drop