Recently, we found one data input for receiving syslog was stopped.
We don't know if the service issue is auto stop or someone disabling it. i tried to search index=_audit,
Also, I even saw some log edit server, only see the action is edit server but it didn't mention what setting had been changed.
