Log indexer - files retention change

[Jacob_W]

Hi,

I did change the log indexer files retention from 14 to 30 days as per below screen.

My question is will log indexer re-index log files to match those 30 days or it will just stop deleting files till it reach new value of 30 days ?

If default is second option is there a way to make it re-index files older then 14 days ?

Thanks

[G_W_Albrecht]

Look into sk111766: R80.x SmartLog/SmartEvent server doesn't index/show logs older than 1-14 days back

[Jacob_W]

Hi, 

I saw it, but it doesn't really answer my question.

What I wonder is if changing setting in smartconsole will take an effect for the past files or will just stop deleting files till they are 30 days old.

[G_W_Albrecht]

Second answer is true - sk111766 states that SMS > R80.20 will index one day only as a default, and shows how to change the number of days to index from CLI.

[G_W_Albrecht]

More about this can be found in sk164054: Daily logs retention policy configuration instructions and sk123259: "log_sys_message: The log repository quota has been exceeded. No file could be deleted" al...

[Jacob_W]

I did what sk111766 describes and one more question. How long it normally takes to reindex logs ? I still see only last 14 days, log_indexes has nothing older as well. $FWDIR/log has logs back for over 100 days. 

[G_W_Albrecht]

It does take some time when re-indexing - but look into $INDEXERDIR/log/log_indexer.elg to see if errors / crashes occur !

[Ruan_Kotze]

It's likely the logs have already been indexed previously - you'll need to follow sk164553 in that case. I have on occasion also just deleted FetchedFiles to "force" re-indexing.

[Jacob_W]

thanks. I'll give it some more time to settle. If that won't help probably tomorrow I'll have to remove fetachedfiles for "full manual reindexing"

Can't see anything bad in log_indexer.log

[Jacob_W]

Unfortunately no joy with re-indexing the last 30 days. We have a logs index for the last 15 days, so it looks like retention setting in smartconsole is working as expected, but log indexer didn't do it's job.

Any other idea before deleteing fetchedfiles ???