What happens if logger storage group limit is reached?
I would like to ask if a logger storage group limit is reached. For example, I configured my storage group to store only 20 GB for 30 days retention. If I reach 20GB before 30 days, are there specific actions that is automatically taken or that can be manually done to archive the data or excess data?
If you reach the storage limit before the retention period, the log archivals won't happen. There will be archival failures and you need to clear the older archives to create space for the new ones.
You can reduce the retention period according to the size of archive you are getting per day. I'm not sure whether you can increase the storage.
The above information is incorrect.
Logger tries to maintain a storeage group % of 90%. Based on capacity and retention.
Retention will trigger either when the event has passed the retention time / or the storage group breaches above 90%.
Logger will remove events based on retention using FIFO (first IN first Out) i.e deleting the oldest events from the storage group first.
Ideally archiving should be scheduled to happen at around 2am and will archive the previous days events. Meaning that should the event be removed from the storage group, they should be available in the archive (if all is working / configured correctly).
If a storage group in logger is above 90%, then the logger will constantly be running the retention process to free up the nesseccary space to ingest new events and this will also cause a performance hit. It also suggests that the storage group is receiving more events than were provisioned for during the planning / deployment phase of the logger.
I recommend to check the Admin guide and best practise guide for more information.
Logger maintains its own space - never remove files from the OS level. If a storage group is above 90%, either provide more space to the storage group or reduce the retention period. Reducing the retention perios will trigger the retention script immediatly, if you find that the storage group still has above 90%, then it will need to be reduced further.
Archiving should be configured to an external location, as it is essentailly a backup. Of course if you run out of space at that location, the archiving will not happen. Logger does not maintain the space on the remote location. If you need to delete old archives to free up space, this should be done via the logger UI. Again, never remove files from that location without doing it through the UI. Also logger will only be able to load / use the archives from the location that they were saved to.
All logger docs can be found here: