> Section: [7. Running it](https://jaque.sh/docs/deployment/choose.md) > Next: deployment/audit-log > Index: https://jaque.sh/llms.txt Operating jaque reduces to operating its event log. What survives a restart is decided by `-eventlog` alone; what is worth backing up is the log's directory or nothing, depending on the backend; and an upgrade is a binary swap, because every projection rebuilds from the log rather than from a schema that could need migrating. This page states those three rules, the retention flags that bound the log's size, and the three failures people actually hit. ## 1. Durability What survives a restart depends entirely on `-eventlog`. `memory`, the default, keeps the event log in process memory only. A restart loses every event, and the projections (current state, history) rebuild from nothing instead of from where they left off. `file://` persists the log to an embedded, on-disk event log store at that path, durable across restarts. `-retain` makes jaque fail fast at startup, instead of running, if `-eventlog` does not guarantee persistence; it is the flag that turns "I meant to configure durability" into a startup error rather than a discovery after the first restart. `nats://` persists to an external, shared event log server, the shared log a multi-engine deployment reads from. ### 1.1 Retention With `file://` or `nats://`, three flags govern how much history the log keeps before compaction drops it. `-eventlog-retain-check-executed` (default `168h`, seven days) is how long `check_executed` events are kept. `-eventlog-retain-state-changed` (default `0`, unbounded) is how long `state_changed` events are kept; `0` is what a full state history needs. `-eventlog-retain-reachability-changed` (default `0`, unbounded) is how long `reachability_changed` events are kept. `-compaction-interval` (default `1h`) is how often the embedded transport's retention pass runs and drops events past those windows. ## 2. Backing up the event log directory With `-eventlog file://`, the durable state is the on-disk event log directory at ``, and there are two ways to protect it. A cold copy: stop jaque, copy the directory, restart. The directory is not safe to copy while the process is writing to it. Replay: with `-eventlog nats://...` the external event log server holds the durable copy. A fresh jaque instance pointed at the same log replays it from scratch, so there is nothing process-local to back up. ## 3. Upgrades Replace the binary and restart. There is no migration step: the event log format does not change across a binary upgrade, and every projection (current object state, dashboard rows, Livestatus tables) rebuilds by replaying the log from wherever it resumes, from the start for `memory` and from where the log left off for `file://` and `nats://`. In a split deployment, restart each role (`engine`, `worker`, `ui`, `sink`, `notifier`) independently; there is no required ordering between them, because none of them talks to another directly. Installed from a package (deb, rpm or apk), the upgrade is the package manager's: install the new version and `systemctl restart jaque`. The unit runs the binary as the `jaque` user with the environment in `/etc/default/jaque`; that file and `/etc/jaque/config.cue` are marked as configuration, so an upgrade never overwrites them. State lives in `/var/lib/jaque`. `jaque version` prints what is running: the release version, the commit it was built from and the build date, one line, no config needed. Run it before and after the swap, and paste it into any report of a problem. The first start of this version on an existing on-disk log builds a per-type index once, walking the whole log; it logs when it starts and when it is done, and the process serves nothing until then. Budget it like a replay. ## 4. Troubleshooting ICMP checks return `UNKNOWN` with permission denied. The `icmp` check uses unprivileged datagram sockets, which most Linux distributions do not allow by default. Run `sudo sysctl -w net.ipv4.ping_group_range="0 2147483647"`, or a narrower group range. See [Quickstart](https://jaque.sh/docs/get-started/quickstart.md). A passive object keeps going `UNKNOWN`. Check its `freshness_threshold`. Once a result is older than that window the object is forced to `stale_status` (`UNKNOWN` by default) until a fresh result arrives. See [Passive checks](https://jaque.sh/docs/ingest/passive-checks.md). jaque will not start, or a listener will not bind. Another process is already on that port. Check `-listen` (dashboard, API, `/metrics`), `-livestatus-listen` (Livestatus TCP) and `-livestatus-socket` (Livestatus UNIX socket) for a conflicting address or path. ## 5. Security considerations An on-disk event log directory or a remote event log stream is the complete monitoring history, including check output, which often carries hostnames, paths and whatever a plugin printed. A backup of it deserves the same handling as the running process's data. The listeners named in section 4 are unauthenticated; [Security](https://jaque.sh/docs/deployment/security.md) says what that implies. `-pprof` mounts the runtime's profiling endpoints under `/debug/pprof/` on the `-listen` address. They expose heap contents and every running call stack, so the flag stays off by default. Turn it on only on an address the operator trusts, and only for the time a profile takes.