Manual Chapter : CE file for Modifying event log indices

Applies To:

Show Versions Show Versions

BIG-IQ Centralized Management

  • 7.0.0
Manual Chapter

CE file for Modifying event log indices

settings specify the physical characteristics of how the data collection device manages your data. The DCD stores data coming in from BIG-IP devices in a data index. As data is received, it accumulates in the current index. When the accumulated data reaches the rotation threshold you set, four things happen.
  • A new current index is created.
  • BIG-IP data begins accumulating in the new index.
  • The former current index becomes one of the retained indices.
  • If the total number of indexes is now larger than the retained index count, the oldest one is dropped.
When you set up index rotation, you determine what triggers the rotation threshold.
The ideal log indices configuration depends on the flow of data your devices send to the DCD. Use the rotation type that best suits your business needs.
  1. On the left, expand
    BIG-IQ Data Collection Devices
  2. Click the
    The Settings screen opens to display the current state of the DCD cluster defined for this BIG-IQ device.
  3. On the Settings screen, click
    Logging Data Collection
    The screen displays the settings defined for the services that are configured to send alerts and events to your DCD cluster.
  4. Specify the
    Rotation Type
    • To chunk your data based on the amount of data:
      1. Select
        Size Based
      2. For the
        Max Index Size
        , type the size of the indexes you want to create.
      For example, if you type
      , when the index size reaches 1 GB, it becomes a retained index and new data from your BIG-IP begins accumulating in a new current index. If your
      Retained Index Count
      is set to 10, then the maximum disk space used by these indexes will be approximately 10 GB.
    • To chunk your data based on the increments of time:
      1. Select Time Based
      2. For the
        Rotation Period
        , specify a time unit, and type how many of those units you want to comprise indexes you want to create.
      For example, if you type
      and select
      , a new index is created every half hour. If your
      Retained Index Count
      is set to 10, then each retained index will contain approximately 5 hours of data.
  5. For the
    Retained Index Count
    , type the total number of indices you want to store on the DCD.
    This setting determines the maximum amount of data stored on the DCD. When this limit is reached, the oldest data is truncated or discarded. For example, if you set the number of indices to 10 and each index is 1 GB, then you must have 10 GB of storage available on your DCD.
  6. Analyze the DCD cluster details listed in the Summary Status area and make sure that the values after upgrade match the values from the health check you performed before the upgrade.
    • Cluster Node Count
    • Data Node Count
    • Document Count
    This information provides a fairly detailed overview that describes the DCD cluster you have created to store alerts and event log data.
  7. Click
    Save & Close
    to save the indices configuration settings.