Log Insight Space Alerts and Data Rotation
Article ID: 420457
Updated On:
Products
Issue/Introduction
Customer receives "Oldest Data Will be Unsearchable Soon" and data rotation alerts similar as below, despite having sufficient free space in Log Insight.
"This alert is about your VMware Aria Operations for Logs installation on https://<Loginsight-fqdn>/
Oldest Data Will be Unsearchable Soon triggered at YYYY-MM-DDTHH:MM:SS
Data will start rotating in about N days M hours at the current ingestion rate on node <Loginsight-fqdn>. This is normal and expected behavior.
Assuming log ingestion rates do not significantly change, this will provide you with approximately N days M hours of searchable log data on this node. Data that has been rotated out will be archived if you have configured archiving, or deleted if you have not. If you would like to retain searchable log data for a longer period of time, you will need to either decrease the quantity of log data being sent to VMware Aria Operations for Logs, or add additional storage to the VMware Aria Operations for Logs virtual appliance on this node. See the Documentation on how to increase storage of the appliance.
Total allocated space: ### GB, free space: ### GB
Environment
VMware Aria Operations for Logs 8.x
Cause
The alert is triggered by the retention time threshold, not by low disk space. By default, VMware Aria Operations for Logs is configured to send a notification when the system's capacity falls below 1 month of searchable data based on the current ingestion rate. In this case, the existing storage can retain less than one month of data at the current log volume, thus activating the alert.
Resolution
This is normal and expected behavior. The alert serves as a proactive notification about data retention, not a storage capacity warning. To extend the retention period for searchable data, consider the following actions:
1. Reduce log ingestion by filtering unnecessary log data.
2. Add storage to the VMware Aria Operations for Logs virtual appliance. Refer to the Online Help for instructions on expanding appliance storage.
3. If longer retention is required, ensure archiving is properly configured to preserve rotated data.
No immediate action is required if the current retention period meets operational needs.
Feedback
