Syslog-ng Store Box stops collecting logs then some hours later starts to receive them again at the same time every day (4287193)

The free disk space is low on SSB.

When the limit of disk usage is reached SSB stops collecting the logs.
See Basic Settings | Management | Disk space fill up prevention (dsfup)

Then archiving processes moves the data from the SSB to the archive share.

That way there is sufficient disk space to start collecting logs again. 

An e-mail alert may be sent out by SSB with the following subject and content.
(See Basic Settings | Alerting & Monitoring | Health related traps | Disk usage is above the defined ratio)

Notification received: XCB-SNMP-MIB::xcbDiskFull

DISMAN-EVENT-MIB::sysUpTimeInstance  646852824

          SNMPv2-MIB::snmpTrapOID.0  XCB-SNMP-MIB::xcbDiskFull

1. Check if the services are still stopped by disk space fill up prevention (dsfup)
    The following status message can be seen at "System monitor". See the screenshot below.

Disk fill-up prevention active! Rejecting connections!

    If that is the case, continue from step 3.

2. Check if dsfup has stopped the services

• Search for the following error messages in the local logspace.
  (Only available if the logs from local source are collected in local logspace. It is the default setting.)

Disk usage ratio limit reached, stopping services

Disk usage ratio went below limit, restarting services

• Check the disk usage (a) and dsfup limit (b)

(a) Move you mouse over the graph bar of "Disk" at the System monitor frame

(b) Basic Settings | Management | Disk space fill up prevention

3. Reduce the retention days in the archive policies to keep less data on the box.

• Navigate to Policies | Backup & Archive/Cleanup | Archive/Cleanup policies
• Select the policy
• Set a lower value for "Retention time in days:"

4. Run archiving

• Navigate to Log | Logspaces
• Click on Archive/cleanup ALL
• Wait for the email notification about the successful archiving (only if it is set in the archive policy) or follow up the disk usage at "System monitor"

If the outage of log reception was not caused by the disk space fill up prevention, open a support ticket with a fresh debug bundle attached.

How to capture a Syslog-ng Store Box debug bundle