Log indexing Q

[D_TK]

Hi - I have an log indexing question.

Log/event VM is r81.10 and it's only doing logging, management is 81.20 and on a seperate vm.  I had log index retention set to 180 days and raw log retention set to a year.  I have to do some research going back to june 1st - which is 264 days ago.  I changed index retention to 280 days on the log server object and installed - i also did an evstop and ran this command on the log server:

$INDEXERDIR/log_indexer -days_to_index 280 -workingDir $INDEXERDIR/

and then did an evstart.  But... there is this note in sk111766:

The solution procedure below will not work properly if the files that need to be re-indexed are already listed as indexed as per the "FetchedFiles".

I've been running this ver on this VM for years, and since these dates in question were definitely indexed at one point in time, they would be in the Fetchfiles file - do i need to go into that file and remove all the entries from june1 - august24?  thanks

[the_rock]

Thats exactly what TAC had me do for one customer recently.

Andy

[Amir_Senn]

It keeps tabs on file that were indexed. If the file is there - it won't be indexed again.

I would suggest not doing it in one time, if there are a lot of logs it may cause heavy load on the log server.

I would test it first on a few log files to see that the load is manageable. Affects could be slowing down indexing new logs.