During the installation process, if a Collector is flagged as ephemeral, the Collector will be deleted automatically after being offline for 12 hours. This can be helpful when using certain APIs, for example, where Amazon Machine Images (AMIs) are constantly created as new Collectors, but serve a purpose for only a short while. After being offline for a while, the AMI-created Collector is automatically deleted.
(Using Quiet Mode installation) To set the ephemeral flag via command line argument:
- When starting the installer from the command line, pass the argument
- Install the Collector.
- Verify that the generated
user.propertiesfile (under the
configdirectory) contains the property
(Using the Binary Package) To set the ephemeral flag via user.properties or sumo.conf file:
- Create the configuration file.
- (Collector version 19.137 and newer) Create and edit the
user.propertiesfile (in the
configdirectory of your Collector installation).
- (Collector version 19.127 and older) Create and edit the
/etc/sumo.confdirectory on Mac or Linux; in the
C:\sumodirectory on Windows).
ephemeral=truein the file, then save and close it.
- Start the Collector.
What happens to logs collected from ephemeral Collectors?
Logs are only deleted from Sumo Logic when your organization’s retention period expires, including data from ephemeral Collectors that have been deleted, meaning that you'll still be able to run searches against logs collected from deleted Collectors. You can also search against metadata for Collectors and Sources that have been deleted.