Smartevent server old index files cleanup

[dehaasm]

We have an issue that our smartevents server only has some last days of reporting available. After some researching I found these old indexed files which consume almost 500GB of data.

How should we clean this up without breaking Smartevents?

find / -type f -size +10000 -exec ls -lh {} \; 2> /dev/null | awk '{ print $NF ": " $5 }' | sort -nk 2,2 | grep 2022

/var/log/opt/CPrt-R81/log_indexes/smartevent_2022-03-02T00-00-00/data/index/_mxh_Lucene50_0.doc: 826M
/var/log/opt/CPrt-R81/log_indexes/smartevent_2022-02-24T00-00-00/data/index/_awx_Lucene50_0.doc: 829M
/var/log/opt/CPrt-R81/log_indexes/smartevent_2022-03-01T12-00-00/data/index/_fi7_Lucene50_0.doc: 831M
/var/log/opt/CPrt-R81/log_indexes/smartevent_2022-02-25T12-00-00/data/index/_n39_Lucene50_0.pos: 837M
/var/log/opt/CPrt-R81/log_indexes/smartevent_2022-02-25T00-00-00/data/index/_uh5_Lucene50_0.doc: 842M
/var/log/opt/CPrt-R81/log_indexes/smartevent_2022-02-26T00-00-00/data/index/_mcn_Lucene50_0.doc: 842M
/var/log/opt/CPrt-R81/log_indexes/smartevent_2022-02-20T12-00-00/data/index/_qi3_Lucene50_0.doc: 843M
/var/log/opt/CPrt-R81/log_indexes/smartevent_2022-02-25T00-00-00/data/index/_mih_Lucene50_0.doc: 843M
/var/log/opt/CPrt-R81/log_indexes/smartevent_2022-02-28T12-00-00/data/index/_eav_Lucene50_0.pos: 852M
/var/log/opt/CPrt-R81/log_indexes/smartevent_2022-03-02T12-00-00/data/index/_n08_Lucene50_0.pos: 872M
/var/log/opt/CPrt-R81/log_indexes/smartevent_2022-02-27T12-00-00/data/index/_b30_Lucene50_0.pos: 873M
/var/log/opt/CPrt-R81/log_indexes/smartevent_2022-03-01T12-00-00/data/index/_v7v_Lucene50_0.pos: 876M

[G_W_Albrecht]

What is set in Dashboard for Daily Logs Retention and Indexes ?

[dehaasm]

Hi it is set for  keep indexed logs for no longer than 30 days and keep log files for an extra 365 days, i guess the files i refer to are indexed logs and should only be kept for 30 days?

[dehaasm]

but perhaps is due to the fact that when i click onlogs i see that "enable log indexing" is disabled perhaps the system does not "look" into that anymore and for that reason not perform a purge of old indexed data? Should we enable this, I am not sure if it was enabled before but I guess so...

[G_W_Albrecht]

Very unusual to disable that - SmartEvent will process the logs, but SmartLog works with indexed logs ! At least 24h indexed logs are a good practice. Open an SR# with TAC to find a save way to clear up unused soace.