Can my license-master still email license alerts if it is in violation

[mataharry]

Here is my problem, I have an enterprise license-master and some scheduled searches triggering email alerts if it records license warnings or violations.
(based on index=_internal source=*license_audit.log* )

But I wonder what will happen when it will be in violation (after reaching 5 warnings), because the search is supposed to be disabled. Will the server silently be locked ?

[BobM]

When you reach 5 license violations, search is disabled. But the _internal index is not blocked for exactly this kind of reason. You need to be able to tell if you are still getting violations and if so where the data is coming from.

[yannK · Accepted solution]

Good concern.

Hopefully, when you are in violation, the search on the _internal index is not disabled, and the scheduling is still running. So the alert email will be sent even if the other indexed cannot be searched.