Cannot search for logs more than N days in Explore Logs

Products

• VMware Aria Suite

Issue/Introduction

• When setting the time range to filter logs more than N days ago, no data/logs are shown.
• Log Management > Index Partitions are configured with a Retention Period longer than N days.
• Under Management > System Monitor > Resources, the Live Storage has been 97% used ( e.g. 4.1 TB out of 4.2 TB.)

Environment

VMware Aria Operations for Logs 8.x

Cause

There is not enough space in Live storage to provide the configured retention due to the log ingestion rate. Aria Operations for Logs deletes old buckets when the available space on the /storage/core partition is less than 3%. Deletion follows a FIFO model. For more details see Key Aspects of the Event Life Cycle

Resolution

• Increase the amount of live storage in the cluster
  • Increase the Storage Capacity of the VMware Aria Operations for Logs Virtual Appliance
  • Add a Worker Node to a VMware Aria Operations for Logs Cluster
    
    
• Reduce the number of ingested logs being stored in live storage
  • Add a Log Filter Configuration
    
    
• Enable data archiving in order to restore logs removed from live storage
  • Data Archiving