ArcSight Logger: licensed data volume limit exceesded
I have the following Message from my logger:
licensed data volume limit exceesded! Logger has Exceeded its Data Volume limit (0) times in the last 30 Days.
All search related features including event forwarding, search and reports are disable.
I need a solution for this Problem Please.
I would recommend to open a support ticket - logger should not disable anything until the license has breached more than 5 times in a 30 day rolling window.
Providing the following details will speed up the request:
-The version of logger
-Tthe system logs which can be generated as follows: Login to the UI > Configuration > Retrieve Logs > save as > “logs.zip”.
-Model if appropriate.
-If the License is being managed by arcmc or logger (stand-alone license)
Would you like to share the solution, so the community can benfit from it.
It may assist someone if they find this post while searching this issue.
is it hardware/software logger ?
is it running on virtualization software ?
any hardening done on virtualization software ?
any hardening done on underling software (ex:CentOS)?
is it managed by ArcMc as well as the licensing ?
if yes, do you have any other logger who could consume your capacity ?