Log indexes not deleting

[Raj_Khatri]

Has anyone run into log indexes not deleting on Log Server?  On the log server under Logs | Storage | Index Files, the "delete index files older than x" days is checked, however they are not clearing.

Logs indexes are stored here: /var/log/opt/CPrt-R80/log_indexes

We have set to 30 days but there are 90 days of log indexes which caused /var/log directory to fill up.  Just curious if this is actually working as designed for anyone or facing the same issue.

[Daniel_Schietin]

Don't have this issue. We have set this to delete index files older than 14 days and inside of "/var/log/opt/CPrt-R80/log_indexes" are no index files available older than 14 days. Seems to be cleaned up correctly in our case.

[Raj_Khatri]

Just out of curiosity, what jumbo take are you running?

[Robert_Yohn]

Where is the setting to have these delete after 14 days?  We don't seem to have that option/setting in R80.10

[PhoneBoy]

In your log server/management object:

[Robert_Yohn]

Thanks for the reply!!

Currently we are logging to our MDS, however looking at that object we do not have the option to delete index files.  Could that object have been created incorrectly?

[PhoneBoy]

What version are you running?

The above screenshot was taken from R80.10 (which incidentally doesn't permit logging to the MDS--known limitation).

However, that option should also exist in earlier versions--see this SK: How to control SmartLog disk (disk) usage 

[Robert_Yohn]

We are running R80.10

[Harshpal_Bhati]

Sk117317 have the answer

[PhoneBoy]

How to configure log maintenance policy for Global SmartEvent 

[Robert_Yohn]

as per the SK115872, it says it is a new feature in R80.10.  We are running R80.10 build 187 and I have attached the screen shot of our MDS that the logs are currently going to.  The last line of the SK "delete index files older than" options removed from domain options and be managed in MDS level only.  We do not seem to have that option.

[Usman_Shaikh]

I have the same issue where the "Delete index files older than..." option was not initially checked on the Seconadry SMS which I have now done and installed the database on both Primary and Seconday but the old index files are still there

Also tried doing evstop/evstart and also smartlogstop/smartlogstart but to no avail

Does it need cprestart ?

[PhoneBoy]

It might need a cprestart.

If that doesn't sort it, I recommend engaging with the TAC.

[Usman_Shaikh]

I have checked this morning and the files have been deleted so perhaps it runs this at a shceduled time (may be the end of the day) and not immediately, so all good now..

Thanks

[Shivajith_S]

@Raj Khatri

Please check selected MBytes in option When disk space is below
It should be greater than your free space.

@ All

do any one know is it possible to move this  /var/log/opt/CPrt-R80/log_indexes and  /var/log/opt/CPrt-R80/log to syslog server.

[PhoneBoy]

What is it that you are trying to do?

Are you trying to replay existing logs to a syslog server? 

[Shivajith_S]

My requirement is to move files from this both location (/var/log/opt/CPrt-R80/log_indexes and  /var/log/opt/CPrt-R80/log) to syslog server ) when management server generates the logs.

In management server we can set 90 days to delete the logs. 

I need to know the steps to be performed ....

Thanks.

[PhoneBoy]

If you want logs to go to a syslog server, you need to use the Log Exporter utility.

See: Log Exporter guide‌