Log store retention

[Samphas1]

Hello CP,

For the logs retention on Smart Management could we able to store for last 3 months or more ?

[G_W_Albrecht]

This depends on a couple of numbers:

- how many events per day are logged

- how much HD space is available on SMS

- is SmartLog indexing / SmartEvent / Reporter used

[Samphas1]

What is the recommendation for the log store retention ?

[Amir_Senn]

This depends on a lot of variables but here's a few thumb rules:

1) We have daily maintenance and emergency maintenance. In daily you can decide how much time you keep the log files and how much time to keep indexes, in emergency you set a threshold of disk space and when it gets lower than the threshold the oldest logs and indexes will be deleted until enough data was deleted to go back over the threshold.

2) Without indexes we can still view the logs, but only opening manually one log file at a time. So if you set daily you need to ask yourself, how far back do I need to view logs and how far back I need to store them. Logs could be re-indexed if needed but indexing of a large number of log files can be resource draining for a time.

Either way I recommend setting retention that will keep you at least 10-15GB in the log partition free.

[Samphas1]

In my site I saw Daily Logs Retention Configuration as below:

   - Keep indexed logs for no longer then 30 days

  - Keep log file an extra 365 days

Noted: But I can reviewed log only last 14 days 

[Amir_Senn]

Did you perform "Install DB" on the relevant server?

I suggest either way to perform "Install DB" and check the $FWDIR/log/fwd.elg for "loaded set" (what it tries to load) and "working set" (actual values. Sometime it can default to this when something is not in order).