Administrator checks the logs and reports from SEPM, he finds that there are only current week's client's device and application logs, and seems some other logs are lost too,
Following is the trouble shooting steps in this case:
1) check the Site's Log Settings, the Log Limit is 99,999,999 entries and Expires after 60 days. the number and days do not come to the limit, so the logs should not be purged by SEPM automatic.
2) not all logs are lost. Some groups' logs are lost and some groups logs exist in these days.
3) From the SQL server database' SEP_client table, we find that many clients status is delete=1. it means many clients are deleted by SEPM and re-registerred to the SEPM. Once the client is deleted from SEPM, the client's logs will be deleted from SEPM. In that case, customer's many clients are deleted automatic after last replication ( because the replication was not done for more than one month. All clients connect to local SEPM was deleted from remote site. after replication, these clients are deleted and re-registerred to local site automatic).
In fact, the situation is by design. If customer wants to avoid the problem, following best practice is helpful.
1) confirm the replication succeed every time. if one replication failed, make it do again and succeed.
2) set delete clients that have not connected for longer days. (default is 30, set it 90 or others)
3) export the clients logs or reports timely.
Imported Document ID: TECH160864
Subscribing will provide email updates when this Article is updated. Login is required.