Old logs that go past the Retention Period are not deleted in Aria Operations for Logs

Products

• VMware vRealize Log Insight 8.x
• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

• An index partition does not delete old logs that are older than the retention period being set for the partition.
• The storage size displayed for the partition on the [Log Management] > [Index Partitions] page is lower than 512 MB.

Environment

Aria Operations for Logs 8.18.x

Cause

Aria Operations for Logs stores logs in buckets. To delete logs in the bucket, the bucket containing the logs needs to be sealed and archived.
However, the sealing process only starts once the bucket has reached its maximum size of 512 MB.
Therefore, if the bucket size is less than 512 MB, it cannot be deleted, even if it contains logs that are older than the retention period settings.

Resolution

This is expected behavior.
The logs cannot be deleted before the bucket which stores the logs reaches the maximum size.

Additional Information

For more information about buckets, see Key Aspects of the Event Life Cycle