Skip to content

DOCS-1701 - Update disabled metrics sources doc to reflect improved source pausing logic #6795

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
amee-sumo wants to merge 1 commit into
base: main
Choose a base branch
from
Open

DOCS-1701 - Update disabled metrics sources doc to reflect improved source pausing logic #6795

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion docs/metrics/manage-metric-volume/disabled-metrics-sources.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,9 @@ Following is an example of the message written to the system event index:

### Sources are disabled when you reach the global limits

When you reach the global limits, Sumo Logic starts disabling your metric sources, starting with the one that is ingesting metrics with the highest cardinality, and continues disabled metric sources in that order, until your metric ingestion is reduced to a volume that is lower than the limit.
When you reach the global limits, Sumo Logic starts disabling your metric sources based on cardinality growth. Rather than targeting the sources with the highest current cardinality, Sumo Logic compares each source's cardinality over the most recent 7-day period against the prior 7-day period, and pauses sources in descending order of cardinality increase. Sources that have recently grown and contributed to the breach are paused first, while stable high-volume sources are left unaffected.

Sumo Logic continues disabling metric sources until your metric ingestion drops below the global limit.

For each source it disabled, Sumo Logic generates a health event and writes a message with level “error” to the [system event index](/docs/manage/security/audit-indexes/system-event-index/). Enter a query to `_index=sumologic_system_events` to see events in the system event index.

Expand Down