When searching for logs in the WebUI of Syslog-ng Store Box (SSB), the following message occurs and no logs appear:
Fetching Logs…
One of the logspaces may have become corrupt and needs reindexing. Please contact One Identity support for assistance in determining the specific logstore in question should it not be apparent which logstore is corrupt.
To reindex all logstore files from a specific day, please run the following from the core-shell of the SSB:
IFS=$'\n';for i in $(ls /opt/ssb/var/logspace/name/*/*/*/messages.store); do echo ${i}|awk -F"/" '{system("/opt/syslog-ng/bin/lgstool reindex -v -n "$7" "$0)}'; done
This could take several hours to run. It's possible that in this time that the console shell might time out so it is recommended to run this via SSH using a program such as Putty.
Once done, searching should work as expected.
© 2024 One Identity LLC. ALL RIGHTS RESERVED. Feedback Terms of Use Privacy Cookie Preference Center