Graylog rotating journal every 15 days although the rotation is set for 30 days

Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question.
Don’t forget to select tags to help index your topic!

1. Describe your incident:
We have setup a graylog environment to get logs from 30+ servers. The config is as follows.

Our logs are rotating every 15 days although we setup the rotation for 30 days

2. Describe your environment:

  • OS Information: Ubuntu 22.04

  • Package Version: Graylog 5.0.13+083613e

  • Service logs, configurations, and environment variables:

3. What steps have you already taken to try and solve the problem?

None as the storage is almost at 86% for the disk.
The proposed step is to increase the indice count from 20 to 24 to see if the rotation is being extended. Once that is done we monitor the storage and see how much disk space it has utilized.
If it is reaching above 90% we increase the storage for the disk and increase the indice size again.
But I want to confirm before performing this as this is production.

4. How can the community help?

Is there a possibility to understand and remediate this issue.

Helpful Posting Tips: Tips for Posting Questions that Get Answers [Hold down CTRL and link on link to open tips documents in a separate tab]

Your event logs are set to rotate monthly. Your default index which holds all your regular log message rotates by message count.

As patrick said your default index (which is the only index holding log messages that you show) is set to rotate by message count, this makes it very hard to have a certain number of days retained. If you are on a newish version I would highly recommend that you switch to time size optimized and let Graylog manage it for you while getting the 30 days you are after.

I will roger that @Joel_Duffield and @patrickmann Will try this config today and update if it has resolved our issue.
Thanks a lot for the swift response.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.