Syslog stopped?

Hey maph_

[x/posted from the Reddit thread for our community users]

Has anything in your XG syslog configuration changed?

Is your disk full?

If possible, have you already attempted a regular appliance reboot?

Reboot of the appliance resolved the issue.  Though I'd still like to know what the root cause was.  A reboot is not always going to be a timely solution.

I have now had this happen to me twice. At the same time 1:22AM EST, I also had users who didn't seem to authenticate, but without logs I couldn't trouble shoot. The first time a reboot corrected it, this time however I booted back to 17.1 as I can't take the chance of having issues while I am off over the holiday.

Were you on 17.5?  If so, clearly seems like some bug.

Sorry, yes it was 17.5

Hi darrengs 

Apologies about this inconvenience. Please feel free to reach out to me or our support hotline if you would like to troubleshoot this issue further. However, it would require you to revert back to your SFOS v17.5 firmware.

Hi maph_ 

Thanks for following up.

Would it be possible to verify the disk usage of your reports?

Thanks,

 It appears is above the 80% threshold from this KBA.   I've performed a manual purge up through this month.  But my report utilization is still at 83% (previously 86% I believe).

Also, what's the best practice here on disk maintenance/management?   Is it is just a matter of tweaking retention rates?  Or can I automate a purge when disk threshold is exceeded.  I should also mention we're using iView too, so I would imagine the reporting is retained there and I can purge almost all of the report data on the XG? 

Perhaps after the new year. I can't take a chance of this happening again while I am out over the holiday.

Darren