recently we found one data input for receiving syslog was stop
we dont know is the service issue auto stop or someone who disable it, i tried to search index=_audit,
also even i saw some log edit server, only see the action is edit server but didnt mention what setting had been changed
↧