Support Center > Search Results > SecureKnowledge Details
R80.x SmartLog/SmartEvent server doesn't index/show logs older than 1-14 days back
Symptoms
  • After upgrading/importing log files into R80.x SmartLog/SmartEvent server, it shows logs only for the last 1-14 days (since the date of the upgrade/import).

  • The $RTDIR/log_indexes/ directory on R80.x SmartLog/SmartEvent server contains directories that go back only for the last 1-14 days (since the date of the upgrade/import).

  • If an offline job is run, the events appear on the "Events" tab, but not on the tabs of specific blades.

  • If an offline job is run to send historical log files to R80 SmartEvent server, the "Files" read as "DDD MM DD HH:MM:SS 1969" (e.g., Wed Dec 31 18:00:00 1969) and show "0" for the number of logs.

Cause

By default, R80.x SmartLog/SmartEvent server indexes and shows logs only up to 14 days back (counting back from the date of the upgrade/import).

Starting from R80.20, only 1 day is indexed by default (fw.log only).


Solution
Note: To view this solution you need to Sign In .