- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi.
VMware Log insight saves events in what they call buckets, which is 0,5GB in size. When the bucket is full it will seal it self and become read only. If you have achiving enabled at the time the bucket will be marked for achiving and copied to the NFS server. Then the bucket will remain on the log insight storage until it is aged out either by the Log Insight running out of space or if you have set any retention periods with partitions.
https://docs.vmware.com/en/vRealize-Log-Insight/8.4/com.vmware.log-insight.getting-started.doc/GUID-...
There is also a good explanation on this blog but it's a bit old so the specifics might not be 100% acurate but it explains how it works.
https://sflanders.net/2015/07/01/log-insight-system-architecture-part-3-archiving/
From my understanding you can't remove events from an log insight appliance manualy. It will age out it's data with the first in first out principle if you are not using partitions to give your data different retention periods.
Regards
//Cederberg