M-100 - Log collector storage commands

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

M-100 - Log collector storage commands

L3 Networker

Anyone know the command to show the actual distribution of current logs on a log collector? Basically, i need the output of "show system logdb-quota" at a collector level. I know how to view my defined % allocations and how view the overall disk space usage. I just need a current view of my current usage by log type, so i can re-allocate more to the log types that we care about.

2 REPLIES 2

L4 Transporter

Hello Chrisp,

Below is the command,

"debug log-collector log-collection-stats show incoming-logs"

This command would show dynamic incoming log rate and the current logs for Traffic, threat, system and so on.

Another command for incoming-blocks is there,

"debug log-collector log-collection-stats show incoming-blocks"

Blocks of log data will be moved from one collector to the other based on a hash-map. These stats will show how many blocks of logs the collector has received from the other collectors in the Collector group. When you have only one collector in the collector group you will not see any of the above stats increasing.


Hope this helps.

L3 Networker

Thanks for the response. I was using that command and did a blocks conversion, but it doesn't seem to match with quota or disk-space utilization numbers.  Someone sent me a link to another article that talks about blkcount conversion, but i can't access that one (doc-5482). Just wanted to verify i was doing it properly. Right now i can't account for quite a bit of space that appears to be in use. We only have one collector in each collector group.

  • 2158 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!