What happens to the data if the log collectors looses the connectivity to decoders

[aruncp333]

We have a scenario here, where my VLCs are in DR and Decoders/ELH in DC. The connectivty between DC and DR fails due to network outage.

1. Does the VLCs store the logs locally? If yes, how much data it can store and for how long ?

2. What kind of data(logs) is lost completely in this kind of scenario?

3. What is the best architectural / configuration recommendation to handle such outage scenario to minimize the data loss?

[Eswar · Accepted solution]

Hi,

Log Collector or rather rabbitmq stores the queued messages on disk in /var/lib/rabbitmq/mnesia/sa@<uuid>/msg_store_persistent. It gets written to disk until the /var/netwitness partition gets full. You will start seeing rabbitmq disk threshold warnings once it hits 80% of total disk.