Key Aspects of the Event Life Cycle

As an event ages, there are key aspects of event storage and management during the event life cycle to be aware of.

Event Storage

Each event is stored in a single on-disk bucket. When working with buckets, be aware of the following behaviors and characteristics.

• Buckets can reach a maximum size of 0.5 GB. When a bucket reaches 0.5 GB, it is sealed and queued for archiving. After a sealed bucket is archived, it is marked as archived. An event can be retained locally and in the archives at the same time.
• Buckets are not replicated across VMware Aria Operations for Logs nodes. If you lose a node, you lose the data on that node.
• All buckets are stored on the /storage/core partition.
• VMware Aria Operations for Logs deletes old buckets when the available space on the /storage/core partition is less than 3%. Deletion follows a FIFO model.
  Note: A near-full /storage/core partition is usual and expected. That partition should never reach 100% because VMware Aria Operations for Logs manages that partition. However, do not attempt to store data on that partition because it can interfere with the deletion of old buckets.

Event Management

As you set up and configure your product, it is helpful to be familiar with the following characteristics and behaviors of VMware Aria Operations for Logs events and event management.

• After an event is deleted locally, it can no longer be queried unless it is imported from the archive using the command-line interface.
• After all events for a machine learning cluster are deleted from VMware Aria Operations for Logs, the cluster is removed.
• VMware Aria Operations for Logs rebalances all incoming events fairly across nodes in the cluster. For example, even if a node is explicitly sent to an event, it might not be the node to ingest the event.
• Event metadata is stored in a proprietary format on a single VMware Aria Operations for Logs node and not in a database.
• An event can exist locally on a node and on the archive.