SSB indexer crashes when content‑based alerts are enabled, resulting in corrupted logstore indexes (4382478)

In syslog‑ng Store Box (SSB), the indexer process may crash intermittently when content‑based alerts are enabled. After each crash, the logstore indexes become corrupted, causing the Search interface to display no logs. Search functionality is restored only after manually reindexing the affected logstores. Core files are generated at the time of the crash.

This issue is caused by a known product defect in the handling of content‑based alerts. The defect can cause the indexer process to crash during the evaluation of content‑based alert rules. The issue is not related to any specific alert rule configuration.

The issue is tracked as Defect 700544, which will be fixed in a future version.

Resolution :

There is currently no permanent fix available in the affected versions.

Workarounds:

• Reduce the number of configured content‑based alert rules.
• Distribute content‑based alert rules across multiple logspaces, keeping fewer alerts per logspace.
• If possible, temporarily disable content‑based alerts to prevent indexer crashes.
• Reindex the affected logstores after a crash to restore Search functionality.

A permanent resolution will be available in a future release that includes the fix for Defect 700544.