Logs not reporting again

[kwhogster]

Hello Every One

Please Lock this mark as closed.

The CentOS would not let me expand the drive

Would not let me install lvm2 using yum

Even adding another drive to the VM and I ran fdisk it failed also

I think not having any disk space left causes these issues.

I even tried deleting the log files etc.

I am now in the process of building a new Vm and this time will give it more disk space

How does NLS clear the files ? Or does it just eat up all your disk space?

Thanks

[rkennedy]

Will close this one up, but first - let me answer your question.

How does NLS clear the files ? Or does it just eat up all your disk space?

You can configure NLS to delete log data after x days, which is how it would clean up data off the machine. For some clients, yes, it will eat up all the disk space because they need to retain it forever.

Let me know if we're good to lock this up following my response.

[kwhogster]

Guys

Got the server rebuilt

Troy your instructions to show the hosts

Go to Dashboards
Make sure the query is *
Under ALL EVENTS, in the left pane is a Fields list
Click the word host
Now there is a pretty list
Click the Terms drop down list and select Table
Now a "Top 10 terms" table appears
Next to the heading "Top 10 terms in field host" is a compass icon
Drag the compass icon up so it adds it to a new panel
In the new panel, click the gear icon (Configure)
General tab -> change the title to All Hosts
Panel tab -> Change the length from 10 to 1000
Click Save

Now you can save this dashboard so you can view it later.


I do this
Go to Dashboards
Make sure the query is *
Under ALL EVENTS, in the left pane is a Fields list
Click the word host
Now there is a pretty list

NO PRETTY LIST

This is after the Log Server cam up for the first time

It shows 12 hosts reporting


For Rkennedy
How or where do I configure NLS to clear the logs

[Box293]

My steps might not be in the correct order, try this:

Go to Dashboards
Make sure the query is *
Under ALL EVENTS, in the left pane is a Fields list
Click the word host
A small window appears overlaid on the screen
Click the Terms drop down list and select Table
Now a "Top 10 terms" table appears
Next to the heading "Top 10 terms in field host" is a compass icon
Drag the compass icon up so it adds it to a new panel
In the new panel, click the gear icon (Configure)
General tab -> change the title to All Hosts
Panel tab -> Change the length from 10 to 1000
Click Save

[kwhogster]

Troy

That worked thanks Now I have a saved dash board with the list of hosts


My only open question now is


How does NLS clear the files ? Or does it just eat up all your disk space?

And Rkennedy responded with this

You can configure NLS to delete log data after x days, which is how it would clean up data off the machine. For some clients, yes, it will eat up all the disk space because they need to retain it forever.


My question is where are these settings

Thanks

[mcapra]

How does NLS clear the files ? Or does it just eat up all your disk space?

NLS uses curator on the back-end to manage the elasticsearch indices.

My question is where are these settings

The settings related to retention can be found under Administration -> Backup & Maintenance.

In a nutshell:

• Open indices, cached to RAM, searchable
• Closed indices, stored on Disk, not searchable
• Deleted indices, gone forever unless stored in a backup/snapshot

[kwhogster]

Thanks

Made the changes

Now just need to keep eye on this for a week or so

[mcapra]

Sure thing! Let us know if there's any developments

[kwhogster]

Guys.

We can Lock this one now as resolved.

Seems to be holding steady on the storage.

Than ks again

[avandemore]

Great, I'll lock this now. If you have further problems please open new thread.