As a default behavior in NSX Advanced Load Balancer, Significant Logs are collected by the Controller only when a user sends a log query to the Controller. As a response to this query, the controller fetches the needed log data from the appropriate SEs, indexes the data, and responds to the user's request.
In the absence of any queries, logs do not go further than the SEs that have collected them. Oldest log entries are phased out (and their disk space freed) on a per-SE basis when an SE runs out of disk space.
Logs gathered by a Controller are replicated across all Controllers within the cluster. Before an SE is removed, the NSX Advanced Load Balancer uploads its log files to the Controller. A new option named logs_processing_auto_sync_and_index in the analytics profile is accessible through the CLI. Use this option to retain the original approach, in which the Significant Logs captured and stored by SEs are regularly uploaded to the Controller and indexed, and the corresponding SE disk space is freed. This option is illustrated by the following CLI sequence.
: > configure analyticsprofile mycustomprofile : analyticsprofile> client_log_config : analyticsprofile: client_log_config> significant_log_processing logs_processing_auto_sync_and_index : analyticsprofile: client log config> save : analyticsprofile> save : > : >
The following excerpt shows significant-log collection turned on and processed in the original fashion.
|------------------------------------+------------------------------------------| | enable_significant_log_collection | True | | significant_log_processing | LOGS_PROCESSING_AUTO_SYNC_AND_INDEX | | filtered_log_processing | LOGS_PROCESSING_SYNC_AND_INDEX_ON_DEMAND | | non_significant_log_processing | LOGS_PROCESSING_SYNC_AND_INDEX_ON_DEMAND | | exclude_server_dns_error_as_error | False | |------------------------------------+------------------------------------------|
