What functionality is no longer available when a syslog-ng Store Box (SSB) license expires?
When a license expires the following functionality is no longer available
Error generating configuration
Error controlling service; init='syslog-ng', control='restart', exit_code='1', output_last_line='See "systemctl status syslog-ng.service" and "journalctl -xe" for details.'
Error connecting to socket; error_code='111', error_msg='Connection refused', endpoint='/opt/ssb/var/logspace/name/center/indexer.ctl'
Once a valid license has been added to the appliances, then commits will be processed, logs will be ingested and the logstores will be searchable again.
However, if there is a time gap between the date the old license expired and the new license was added then there will be a corresponding gap in log collection as can be seen in the following image.