Hi Team,
Just wanted to confirm on how we can delete disconnected syslog hosts and agents from vRLI UI.
The syslog hosts and agents were reporting properly and if we decommission the source machines then we are left with stale disconnected entries of those machines under syslog hosts and agents tab of vRLI UI. How can we deal with this problem?
Is there a specific period that vRLI will keep these stale entries and will delete them automatically once that period is over? or is there anything we can do at the appliance level to deal with it.
Hi.
At least for Hosts inactive hosts are removed three months after the last ingested event. According to Vmware documentation.
"Entries in host tables expire three months after the last ingested event."
Monitor Hosts That Send Log Events
I'm guessing but can't confirm it might be the same for agents?
If so much as a single log was sent, they will show forever and there's no way to purge them. This is by design.
Hi.
At least for Hosts inactive hosts are removed three months after the last ingested event. According to Vmware documentation.
"Entries in host tables expire three months after the last ingested event."
Monitor Hosts That Send Log Events
I'm guessing but can't confirm it might be the same for agents?
Yes, you are correct, that is the that we will have to wait, there is nothing mentioned for agents. I was hoping if there is any wait to delete stale entries from the appliance or api. I have read a vmware community discussion that said the disconnected agents only get removed when the vRLI cluster is rebooted.