OpenSpec follow-up: sysmon payload limits and downsampling #3174

Open
opened 2026-04-24 02:29:53 +00:00 by mfreeman451 · 0 comments
Owner

OpenSpec IDs:

  • add-configurable-sysmon-payload-limit
  • update-sysmon-downsampling

Priority: P1

Why this is next:

  • Existing open issues point at sysmon cleanup and richer host telemetry: #1039, #1040, #909, #793, #737.
  • Payload sizing and downsampling reduce ingestion risk before adding more metrics.

Initial scope:

  • Confirm current sysmon payload limits, upload interval, and sampling behavior.
  • Decide whether payload-limit config and downsampling are still needed as separate changes or one implementation slice.
  • Update OpenSpec tasks and implement the smallest safe config/runtime change.
OpenSpec IDs: - `add-configurable-sysmon-payload-limit` - `update-sysmon-downsampling` Priority: P1 Why this is next: - Existing open issues point at sysmon cleanup and richer host telemetry: #1039, #1040, #909, #793, #737. - Payload sizing and downsampling reduce ingestion risk before adding more metrics. Initial scope: - Confirm current sysmon payload limits, upload interval, and sampling behavior. - Decide whether payload-limit config and downsampling are still needed as separate changes or one implementation slice. - Update OpenSpec tasks and implement the smallest safe config/runtime change.
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
carverauto/serviceradar#3174
No description provided.