The dropped messages reports lists all available logstores from syslog-ng-ctl stats, including logstores that were removed during an archive or cleanup process.
This is caused when old logstores visible in the client report have a valid archive policy set on them, and were removed from the SSB. They are not visible when performing a logspace search. The list of logstores is cleaned up only when syslog-ng is restarted.
Restart syslog-ng when a report gets really long.
A restart can be done through the UI by going to "Basic Settings", then "System". From there, click on "Restart syslog-ng" under "Service control".
The other way to perform the restart is from the core-shell by issuing the following command: