Platform settings

Platform settings live in the protected _sys organization. Switch to it with the workspace switcher; platform administrators and the Owners of enabled organizations can enter it. The pages appear under Settings there, and each requires a platform permission.

Section	Group	Permission
Organization management	Platform	`sys.organizations.manage`
Client IP recognition	Data plane	`sys.settings.manage`
Data retention	Data plane	`sys.settings.manage`
Metric cardinality	Data plane	`sys.settings.manage`
Audit retention	Data security	`sys.settings.manage`

Every node reads these settings from the database, so a change needs no restart.

Organization management

Organization management lists the tenant organizations of the instance with the name, the slug, the status, and the ID.

Action	Effect
Create organization	Creates a tenant organization from a Name and a Slug. The slug cannot change later.
Disable	Stops access to the organization at once: its sessions and API credentials are refused until it is enabled again.
Enable	Gives the members and the credentials of the organization access again.
Delete	Deletes the organization for good.

At least one tenant organization must stay enabled, and the _sys organization itself cannot be changed. Manage the members of an organization from its own Identity & Access, after Manage IAM on Organizations.

Client IP recognition

RUM intake records the address of each browser or device, and looks it up for the country, the subdivision, and the city. Client IP recognition decides where the address comes from. It applies to every organization.

Address source	Use
Direct connection address	The default. Uses the TCP peer and ignores every forwarding header. Right when the intake endpoint is exposed directly.
Single-value header	Reads one bare IP from a header that a CDN or proxy sets, such as `CF-Connecting-IP`.
Forwarded IP chain	Walks an IP chain such as `X-Forwarded-For` from right to left, skips the trusted proxies, and takes the first address that is not trusted. Maximum chain length limits the addresses read from one request, 1 to 64.

Behind a proxy, also set:

Field	Rule
Client IP header	The header to read. `Authorization`, `Cookie`, API key, and client certificate headers are refused.
Trusted proxy CIDRs	One IPv4 or IPv6 CIDR per line, up to 64. The header is read only from a connection whose peer is in these networks. A `/0` network trusts every source of its address family: use it only behind a protected ingress.
Fall back to connection address	Uses the TCP peer when the header is missing, malformed, too long, or holds no usable address.
Allow private addresses from headers	Accepts private, loopback, and link-local addresses from the header. Keep it off for public browser traffic.

Data retention

Data retention sets how many days a stream without a retention of its own is kept: 30 by default, from 1 to 3650. Each stream can set its own under Streams. Data older than the retention is deleted in the next cleanup and cannot be recovered.

Metric cardinality

Metric cardinality limits how many Prometheus series stay active at once, so labels with many values cannot exhaust memory and storage.

Limit	Default	Meaning
Per organization	200,000	The active series of one organization.
Per metric	100,000	The active series of one metric in an organization. At most the organization limit.

At a limit, writes of new series are refused while the existing series keep being written. A series that receives no data for a while is no longer active. Nodes read the limits again every 30 seconds. Find the labels that create series with the cardinality view of Metrics.

Audit retention

Audit retention sets how many days the audit records of every organization and of the platform are kept: 90 by default, from 0 to 3650, where 0 keeps them forever. Older records are deleted once a day and cannot be recovered. Each change is recorded in the platform audit as audit_retention.update.

Get started

Data

Observe

Query and correlate

Reliability

AI ops

Collaboration

Admin

Deploy & operate

Best practices

Resources

Organization management

Client IP recognition

Data retention

Metric cardinality

Audit retention

​Organization management

​Client IP recognition

​Data retention

​Metric cardinality

​Audit retention

Organization management

Client IP recognition

Data retention

Metric cardinality

Audit retention