Page 2 of 2

Re: Incides are not backing up

Posted: Thu Nov 12, 2015 10:03 am
by scottwilkerson
krobertson71 wrote:Here are the results on your command.

No the size will vary along with the date. Two days from now they will read 4-27 etc...

Code: Select all

 nagioslogserver]$ ls -l /usr/local/nagioslogserver/elasticsearch/data/907e60a9-dc29-411e-96e8-2dfe503e0867/nodes/0/indices
total 56
drwxr-xr-x 8 nagios nagcmd 4096 May 11  2015 kibana-int
drwxr-xr-x 8 nagios nagcmd 4096 Nov 10 18:03 logstash-2015.04.25
drwxr-xr-x 8 nagios nagcmd 4096 Nov 11 11:50 logstash-2015.04.26
drwxr-xr-x 8 nagios nagcmd 4096 Nov  3 14:00 logstash-2015.11.04
drwxr-xr-x 8 nagios nagcmd 4096 Nov  4 14:00 logstash-2015.11.05
drwxr-xr-x 8 nagios nagcmd 4096 Nov  5 14:00 logstash-2015.11.06
drwxr-xr-x 8 nagios nagcmd 4096 Nov  6 14:00 logstash-2015.11.07
drwxr-xr-x 8 nagios nagcmd 4096 Nov  7 14:00 logstash-2015.11.08
drwxr-xr-x 8 nagios nagcmd 4096 Nov  8 14:00 logstash-2015.11.09
drwxr-xr-x 8 nagios nagcmd 4096 Nov  9 14:00 logstash-2015.11.10
drwxr-xr-x 8 nagios nagcmd 4096 Nov 10 14:00 logstash-2015.11.11
drwxr-xr-x 8 nagios nagcmd 4096 Nov 11 14:00 logstash-2015.11.12
drwxr-xr-x 4 nagios nagcmd 4096 May 11  2015 nagioslogserver
drwxr-xr-x 8 nagios nagcmd 4096 May 11  2015 nagioslogserver_log
You likely have a machine sending logs that has it's date messed up, the easiest way to find what it is would be to go to the Log Server dashboard, and from the date dropdown choose custom, and select a date range that includes 04-25-2015 - 04-26-2015

this will help decipher what machine has the wrong date on it.

Re: Incides are not backing up

Posted: Tue Nov 24, 2015 10:04 am
by krobertson71
Sorry for such a long delay in responding.

Yes it is an ESX host in one of our datacenters.

I am still waiting to hear back from the ESX team who will be the ones to correct the issue.

Hopefully this will set things right again.

I will update thread when that is complete.

Re: Incides are not backing up

Posted: Tue Nov 24, 2015 11:18 am
by tmcdonald
No worries, we'll keep this open for you.