Hi Guys,
We had a series of events that meant our SUFs were unable to forward to their respective indexers for about 10-days.
For this whole time, the queues were blocked.
Unfortunately, for those 10-days, it appears we have lost data :(.
I have read up a bit about queues, but one thing I am unsure about is what happens when the queues are blocked?
And in my situation, where communication was lost for an extended period of time, do events cache on local disk, if so, for how long? I checked limits.conf but couldn't find much, apart from maxqueuesize.
I guess I need to find the root cause, and future mitigation, of the data loss for the higher-ups. Cheers.
... View more